United States v. Sterlingov

UNITED STATES OF AMERICA, v. ROMAN STERLINGOV, Defendant.

CRIMINAL ACTION No. 21-399 (RDM)

United States District Court, District of Columbia

November 10, 2021

MEMORANDUM OPINION AND ORDER

RANDOLPH D. MOSS, United States District Judge.

This matter is before the Court on Defendant Roman Sterlingov's motion to revoke his pretrial detention. Dkt. 17. Sterlingov has been charged with money laundering operating an unlicensed money transmitting business, and money transmission without a license, all in relation to his alleged operation of a Bitcoin mixer known as Bitcoin Fog. Dkt. 8. Sterlingov, a dual citizen of Sweden and Russia, Dkt 1-1 at 1, was arrested on April 27, 2021, in Los Angeles California, when he arrived at Los Angeles International Airport, Dkt. 5. Magistrate Judge Paul L. Abrams of the United States District Court for the Central District of California ordered that Sterlingov be detained pending trial. Dkt. 17-1 at 5. Sterlingov now moves to revoke that order and requests release on home detention, subject to various conditions including location monitoring and internet restrictions, pending trial.

For the reasons that follow, the Court will DENY Sterlingov's motion, Dkt. 17.

I. BACKGROUND

The following background is taken from the government's charging instruments, the affidavit of Special Agent Devon Beckett, the parties' briefs and proffers at the hearing held on October 25, 2021, and the exhibits tendered to the Court. See United States v. Smith, 79 F.3d 1208, 1209-10 (D.C. Cir. 1996) (defendant and the government may proceed by way of proffer); 18 U.S.C. § 3142(f) (providing that usual “rules concerning admissibility of evidence in criminal trials do not apply to the presentation and consideration of information at” a detention hearing). It bears emphasis, however, that the Court's description of the relevant facts is necessarily preliminary and incomplete and does not represent a determination on the merits, which is both premature and, in any event, the province of the jury.

The government alleges that Sterlingov operated “an illicit Bitcoin money transmitting and money laundering service” known as Bitcoin Fog. Dkt. 1-1 at 1; see also Dkt. 8 (indictment). “Bitcoin is a decentralized form of electronic or digital currency that exists only on the internet.” United States v. Harmon, 474 F.Supp.3d 76, 80 (D.D.C. 2020) (quotation marks and alterations omitted). The term “bitcoin” refers to both “a system” that facilitates financial transactions and “a unit” of currency. Id. Bitcoin the system “is a peer-to-peer network enabling proof and transfer of ownership-of units, or tokens, also called bitcoin-without involving a third-party such as a bank, ” id., while bitcoin the unit is a virtual currency “transacted over the Internet using Bitcoin software, ” Dkt. 1-1 at 1 n.1.^[1] This software permits users to create “‘Bitcoin addresses,' roughly analogous to anonymous accounts, ” and to “securely transfer[] bitcoin from one Bitcoin address to another.” Id. “[T]he identity of a Bitcoin address owner is generally anonymous, ” although “law enforcement can often identify the owner of a particular Bitcoin address by analyzing the blockchain, ” which “is essentially a distributed public ledger that keeps track of all Bitcoin transactions, incoming and outgoing, and . . . records every address that has ever received a bitcoin and maintains records of every transaction.” Id. at 3 & n.3.

As explained in the affidavit of Devon Beckett, a Special Agent assigned to the Internal Revenue Service, Criminal Investigation (IRS-CI), Bitcoin Fog is a bitcoin mixer (or tumbler) that offers further anonymity to those engaged in bitcoin transactions. Id. at 1-2. Bitcoin Fog can only be accessed through a “Tor hidden website.” Id. at 1. Tor “is a computer network designed to facilitate anonymous communication over the Internet, ” id. at 1 n.1, “by routing user's communications through a global network of relay computers (or proxies), thus effectively masking the internet-protocol (‘IP') address of the user, ” United States v. Galarza, No. 18-mj-146, 2019 WL 2028710, at *2 (D.D.C. May 8, 2019) (quotation marks omitted). Because of the sophisticated methods used by the Tor network to conceal both users and website hosts, “neither law enforcement nor hidden-service users can use public lookups or ordinary investigative means to determine the true IP address-and therefore the location-of a computer server that hosts a hidden service.” Dkt. 1-1 at n.1. “For these reasons, hidden services are often referenced as residing on the ‘darknet' or ‘Dark Web,' and ordinary Internet websites are often referenced as residing on the ‘clearnet.'” Id.; see also Harmon, 474 F.Supp.3d at 82 (describing the darknet).

Once users access Bitcoin Fog, the service enables them “to send bitcoins to designated recipients in a manner designed to conceal and obfuscate the sources of the bitcoins.” Dkt. 1-1 at 1-2. Bitcoin Fog does this by “disassociating incoming bitcoin from particular Bitcoin addresses or transactions and then comingling that bitcoin with other incoming bitcoin prior to conducting further transactions.” Id. at 2. “This process, ” according to the government, permits Bitcoin Fog “customers engaged in unlawful activities to launder their proceeds by concealing the nature, source, and location of their ‘dirty' bitcoin.” Id. Although the case is at a preliminary stage, the government has offered some evidence that Bitcoin Fog was aware of the nature of its customer base. At its launch, an announcement on an online Bitcoin forum advertised that Bitcoin Fog's mixing services “can eliminate any chance of finding your payments[, ] . . . making it impossible to prove any connection between a deposit and a withdraw[al] inside our service, ” id., and a subsequent post on the same forum (dated a few months later) contrasted Bitcoin Fog with “legitimate, visible businesses, which will be forced to reveal information about [users'] funds, should such a request be made by the authorities, ” id. at 3. Such tactics would prove difficult with Bitcoin Fog, the second post continued, because “the authorities have to find [us] first.” Id.; see also Dkt. 19 at 4 (Figure 3) (announcing as part of launch that “not only will we not cooperate with any authorities, the authorities will not actually be able to show up at our doorstep, because finding a [T]or doorstep has proven difficult”). According to the Beckett affidavit, over 1.2 million bitcoins-worth over $335 million at the time of the transactions- have been sent through Bitcoin Fog since the site's launch in 2011. Dkt. 1-1 at 3-4.

A substantial portion of that sum, Special Agent Beckett attests, has been linked to online marketplaces known to facilitate unlawful conduct. Federal law enforcement used blockchain analysis to “identify bitcoins sent directly to [Bitcoin Fog] from known darknet markets and bitcoins sent from [Bitcoin Fog] to known darknet markets, ” which “primarily traffic in illegal narcotics and other illegal goods and services.” Id. at 4. One such darknet market, Silk Road, has been described elsewhere as “the most sophisticated and extensive criminal marketplace on the Internet.” United States v. Ulbricht, 31 F.Supp.3d 540, 549 (S.D.N.Y. 2014). According to the Beckett affidavit, the government has identified “$78 million in transactions” that Bitcoin Fog sent or received “involving known darknet markets, counting only direct transactions.” Dkt. 1-1 at 4. The evidence further suggests that Bitcoin Fog had a relationship with the darknet market Agora, which the government describes as “one of the darknet's largest illegal marketplaces selling illegal narcotics and other goods.” Dkt. 19 at 8. When Agora launched in December 2013, for example, Bitcoin Fog explained to its users that “[t]he marketplace is operated by associates of ours in whom we have complete trust both in terms of not being a honeypot (if they were, we would be in jail) and in terms of their security expertise.” Id. at 10 (Figure 8). Bitcoin Fog users encountered this message, in the form of an advertisement, when they logged into the service following Agora's launch. Id. at 9 (Figure 7).

Bitcoin Fog's founder and “principal operator, ” according to the government, was the Defendant in this case Roman Sterlingov. Dkt. 1-1 at 7. As the Beckett affidavit recounts, when the site was founded in October 2011, a user with the pseudonym Akemashite Omedetou announced the launch on BitcoinTalk.org, an online forum. Id. at 2. The announcement included links to Bitcoin Fog's clearnet site, its Tor site, and its Twitter feed. Id. The clearnet site domain-its non-Tor website, id. at 1 n.1-was registered to the same pseudonym, Akemashite Omedetou, and paid for from a Liberty Reserve account, id. at 7. Liberty Reserve, which has since been shut down by U.S. law enforcement based on money laundering charges against its founder, “was a Costa Rica-based digital currency exchange service that allowed users to register and transfer money to other users with only a name, e-mail address, and birth date.” Id. at 7 n.5. That Liberty Reserve account was traced, through a six-layered transaction involving four different currencies, to a different bitcoin account-this time the Japan-based Mt. Gox exchange-that Sterlingov “opened . . . in his true name.” Id. at 8. See generally Id. at 7-9 (describing law enforcement's efforts to determine the identity of the Liberty Reserve account holder); Dkt. 19 at 20 (diagramming the various transactions through which the government linked Sterlingov to the pseudonym Akemashite Omedetou). Investigators later obtained, via search warrant, the contents of a Google account linked to Sterlingov's telephone number. ...