United States v. 155 Virtual Currency Assets

UNITED STATES OF AMERICA, Plaintiff, v. 155 VIRTUAL CURRENCY ASSETS, Defendants.

Civil Action No.: 20-cv-2228 (RC)

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA

April 9, 2021

Re Document No.: 10

MEMORANDUM OPINION

GRANTING PLAINTIFF'S MOTION FOR ENTRY OF DEFAULT JUDGMENT

I. INTRODUCTION

This action arises out of an investigation by the Internal Revenue Service Criminal Investigation's Cyber Crimes Unit, the Federal Bureau of Investigation, and Homeland Security Investigations. Plaintiff United States of America ("the Government") seeks the forfeiture of 155 virtual currency assets (collectively, "Defendant Properties") that were involved in a number of transactions that directly or indirectly supported and financed terrorism. No claimant to the assets has responded to the complaint, and the Clerk of the Court entered default on February 26, 2021. The Government now asks this Court to enter a default judgment against the Defendant Properties. For the reasons set forth below, the Court grants this motion.

II. FACTUAL BACKGROUND

This case involves a number of entities designated by the United States Secretary of State as Foreign Terrorist Organizations ("FTOs"), including al-Qaeda, Jam'at al Tawhid wa'al-Jihad, and al-Nusrah Front, as well as their aliases and entities soliciting donations to financially support them. According to the Government, a number of entities solicited online donations of bitcoin, a decentralized virtual currency, to finance these FTOs. The Government alleges that this scheme ran afoul of 18 U.S.C. § 2332b, an antiterrorism statute, and that the entities' assets are thus subject to forfeiture pursuant to 18 U.S.C. § 981(a)(1)(G)(i). The Court will briefly summarize the relevant law and describe the alleged financing scheme in more detail.

A. Statutory Framework

Federal statute makes "[a]ll assets, foreign or domestic[,] of any individual, entity, or organization engaged in planning or perpetrating any . . . Federal crime of terrorism" subject to forfeiture to the United States. 18 U.S.C. § 981(a)(1)(G)(i). Numerous offenses may qualify as a "Federal crime of terrorism" so long as they are "calculated to influence or affect the conduct of government by intimidation or coercion, or to retaliate against government conduct." Id. § 2332b(g)(5). One such offense is "knowingly provid[ing] material support or resources to a foreign terrorist organization." See id. § 2339B(a); see also id. § 2332b(g)(5)(i). For the purposes of that offense, a "terrorist organization" is any organization designated as such under section 219 of the Immigration and Nationality Act. Id. § 2339B(g)(6).

This statutory scheme "empowers the government to seek the forfeiture of property outside the United States, which may have never touched the United States. The broad expanse of this language is for forfeiture actions to reach all property of terrorist organizations." United States v. One Gold Ring with Carved Gemstone, No. 16-CV-2442, 2019 WL 5853493, at *1 (D.D.C. Nov. 7, 2019).

B. Relevant Facts and Procedural History

The Government outlines in its verified complaint a number of instances in which various organizations solicited, via social media, donations that directly or indirectly financed a numberof FTOs. Before describing the alleged financing scheme, the Court will briefly explain the method of financing, Bitcoin.¹

Bitcoin is a decentralized virtual currency, sometimes referred to as "cryptocurrency," which is supported by a peer-to-peer network. Compl. ¶ 14, ECF No. 1; see also United States v. Harmon, 474 F. Supp. 3d 76, 80 (D.D.C. 2020). All transactions are posted to a public ledger called the blockchain. Compl. ¶ 14. Transactions occur between bitcoin addresses, which consist only of a complex series of numbers that contains no information identifying the parties involved. Id. The cryptocurrency's pseudonymous nature makes it favored by many criminal actors who use it to facilitate illegal transactions, such as purchasing drugs or illegal services. Id. As of writing, the value of one unit of bitcoin is $52,133.23. See Bitcoin, Blockchain.com, https://www.blockchain.com/explorer (last visited Mar. 25, 2021).

Despite Bitcoin's pseudonymous nature, law enforcement can sometimes identify parties to a transaction. Compl. ¶¶ 15-19. By analyzing the blockchain (the public ledger that records transactions) law enforcement can ascertain the counterparties' unique bitcoin addresses. Id. ¶ 17. And because users often combine multiple bitcoin addresses and use them together in the same transaction (a "cluster"), analysis of one transaction might reveal many addresses belonging to a single individual or organization. See id. ¶¶ 15, 17. Several private companies have used that kind of analysis to identify bitcoin address clusters associated with the same parties. Id. ¶¶ 17-18. With the right clues, one can then attribute a cluster to a particular individual or organization. Id. ¶¶ 17-19. Authorities took advantage of third-party blockchain software to perform the investigation here. Id. ¶ 17.

The Government outlines a scheme in which several organizations solicited donations for FTOs. To begin, the Government investigated groups on the social media platform Telegram, including one named "Tawheed & Jihad Media" ("Tahweed"). Id. ¶ 20. Tahweed asked supporters to send donations for al-Qaeda soldiers to its bitcoin address, labeled in the complaint as "Defendant Property AQ1" ("AQ1"). Id. ¶¶ 21-22. AQ1 sent its entire balance of bitcoin to a cluster of bitcoin addresses, Defendant Property AQ2 ("AQ2"), which was identified as a central hub used to collect and redistribute funds to FTOs. Id. ¶¶ 23-25. AQ2 received approximately 15.27050803 bitcoin via 187 transactions from February 2019 to February 2020. Id. ¶ 25. Between February 25 and July 29, 2019, AQ2 sent approximately 9.10918723 bitcoin to Defendant Property 1, an account at a virtual currency exchange, which then disbursed the money through online gift cards, a common method of money laundering. Id. ¶¶ 26-27. In May 2019, AQ2 received bitcoin from Defendant Property 2, another address, which then sent approximately 0.07630859 bitcoin to yet another address, Defendant Property 3. Id. ¶¶ 26-27. Defendant Property 3 subsequently transmitted bitcoin to AQ2. Id. ¶ 27.

Another organization, Leave an Impact Before Departure ("LIBD") allegedly solicited bitcoin donations via social media to equip, support, and finance militants in Syria. Id. ¶ 30. LIBD posted images seeking funds for military equipment. Id. ¶ 30-31. Its bitcoin address, Defendant Property 4, received approximately 14.58133728 bitcoin via 65 transactions from March 10, 2019, to December 11, 2019, including seven transactions receiving bitcoin from AQ2. Id. ¶ 34. A cluster of 29 bitcoin addresses, Defendant Properties 5-33, received approximately 0.29328346 bitcoin from AQ2 and then sent 0.76916964 bitcoin to Defendant Property 1 and 0.2270076 bitcoin to Defendant Property 4. Id. ¶ 35.

A third organization, Al Ikhwa, allegedly sought donations via Telegram too. Id. ¶ 36. Al Ikhwa posted eleven bitcoin addresses to receive donations, collectively Defendant Properties 34-44 or "Al Ikhwa Cluster." Id. ¶ 38. Half of the bitcoin received by this cluster was sent to AQ2, which then sent bitcoin to Defendant Property 1. Id. ¶ 40-41. Al Ikhwa also posted four bitcoin addresses on Facebook soliciting donations. Id. ¶ 42. Two of these were part of the Al Ikhwa cluster, and the other two were a cluster of six more addresses, collectively Defendant Properties 45-50 or "Al Ikhwa Facebook Cluster." Id. Al Ikhwa Facebook Cluster sent approximately 0.09413247 bitcoin to the Al Ikhwa Cluster during April and May of 2020. Id. The Al Ikhwa Cluster sent various amounts of bitcoin through layered transactions to AQ2 from January 2019 to July 2019. Id. ¶ 45.

Al Ikhwa is connected to Malhama Tactical, a jihadist military company that trains fighters in Syria and has solicited donations for Hayat Tahrir al-Sham ("HTS"), an alias of al-Nusrah Front, another FTO. Id. ¶¶ 12, 46-48. The Twitter account of Malhama Tactical's founder, Abu Salman Belarus, solicited donations to two bitcoin addresses. Id. ¶ 50. These addresses are part of a cluster of twenty-three bitcoin addresses, Defendant Properties 51-73 or "MT Cluster," that on October 9, 2018 sent approximately 0.03839 bitcoin to another cluster that has previously sent bitcoin to AQ2. Id. ¶¶ 51-52.

The Government identifies another organization, Reminders from Syria ("RFS") that has forwarded posts by (and has had its own posts forwarded by) Al Ikhwa on Telegram that include the address of Al Ikhwa's bitcoin account. Id. ¶ 53. An undercover Homeland Security Investigations agent messaged the administrator of the RFS Telegram channel asking for an address to donate bitcoin to, and the administrator provided a bitcoin address, Defendant Property 74, which was clustered with Defendant Property 75 and 76. Id. ¶ 56. Theadministrator also shared his own "wallet," Defendant Property 77. Id. ¶ 58. Defendant Property 77 and the RFS Cluster both sent bitcoin around the same time on July 23, 2020 to a cluster of bitcoin addresses that then sent the majority of the funds to another address, Defendant Property 78, which is hosted at the same exchange as Defendant Property 1. Id. ¶¶ 60-61.

The final organization, Al Sadaqah, is a Syrian organization that describes itself as a charity, id. ¶ 63, and has solicited donations on Telegram, including one post that directed the readers to donate to provide "the Mujahidin in Syria with weapons, finicial [sic] aid and other projects relating to the jihad." Id. ¶ 63. Al Sadaqah solicited donations to a bitcoin address, Defendant Property 79, which is clustered with another address, Defendant Property 80. Id. ¶ 63.

The Government filed a verified complaint on August 13, 2020 for forfeiture in rem against the Defendant Properties, claiming these...