Police Studied IDC Financial Crime for Years

On April 28, Italian news outlets published a breaking story that spread rapidly. Authorities in Lecco, Italy, announced a pivotal moment in an undercover operation into an entire dark web forum. The forum, Italian Darknet Community (IDC), functioned as both a forum and marketplace—and given that it appeared on many darknet marketplace lists, many knew IDC as only a darknet marketplace.

On that date, the Police of Lecco and Central Operational Service held a live press conference wherein they spoke of the details of the aforementioned pivotal moment. The press conference covered a 15-month darknet investigation by law enforcement in Italy. In January, 2016, officials explained, special groups of investigators infiltrated the IDC. The use of undercover tactics, they explained, lead to several small arrests throughout the course of the investigation but the so-called “little fish” were not the target.

In 2013, following the destruction of the Silk Road, US authorities alerted Italian law enforcement of a “dangerous” darknet vendor in Italy. The vendor, Kriminale, sold on the Silk Road but, after the notorious downfall, he moved to other marketplaces. One of those marketplaces was the Italian Darknet Community. Through his sadness on the IDC, Kriminale trafficked enough MDMA, amphetamine, cocaine, LSD, cannabis, and heroin to land on Italy list of high-ranking vendors. According to the Central Operational Service, Kriminale was “one of the largest Italian darknet vendors and one of the reference points for the online trafficking of drugs in Italy.”

Like American authorities, Italian law enforcement was unable to locate the vendor. As of the writing of this article, there was not any evidence from an official source that the investigation into Kriminale ended, but everything provided by law enforcement indicated that it had. While he was an important target, an even greater target emerged.

In 2015, the Ministry of Economy and Finance’s Anti Fraud Department published a report on financial cybercrime and fraud. The report, as one might expect given the department’s focus, covered every imaginable form of cybercrime that related to fraud, and specifically financial fraud within Italy.

The report explained cybercrime in a brief summary. Mainly hacking and phishing and the role that both played on financial stability. It then quickly proceeded to financial crime payments: Bitcoin, the report explained. From bitcoins, the connection between money laundering and Bitcoin tumbling appeared obvious. The report called the process “Bitcoin recycling” and used Bitcoin Fog as the face of the crime.

“Services such as Bitcoin Fog will distribute the amount deposited by each user in a number of normal-looking payments,” the report explained. “Some of these platforms exploit the level of anonymity offered by the Tor Network. The cybercrime-as-a-service model is a popularity in the criminal ecosystem.” (Edited for clarity. Note that the report referred to any Bitcoin blending service, including online gambling, as a “cybercrime-as-a-service.”

From there, the report moved to why anyone needed Bitcoin tumblers. Researchers added an in-depth analysis of the most popular darknet marketplaces. In this case, and fittingly so, the report called marketplaces “darknet communities.” Alphabay appeared at the top of the list and served as a comparison for other marketplaces, including IDC.

“Percentage of payment fraud products per single Black Market”

“Although the community ‘Italian Darknet Community’ is not comparable to the business volume of Alphabay,” the report explained. “It’s worth analyzing it to understand how Italian actors are positioning in the criminal ecosystem.” It continued, “the Italian darknet community market sellers sell prepaid credit or debit cards, but after months of observation, only a few users have offered US cards.”

While law enforcement agencies are rarely unaware of a marketplace, the Ministry of Economy and Finance’s Anti Fraud Department clearly knew much more than the mere fact that the marketplace existed. While knowing that the marketplace existed and formally starting an investigation are two not inherently linked, the entirety of the report demonstrated a very in depth analysis wherein the report explicitly mentioned collaboration with the police.

From a section with a summarization of the report and work from the SNAI:

With multi-tiered order forces to;

• Identify and implement any further effort to counteract this phenomenon;
• Create a system capable of providing law enforcement with all the information useful to illegal activity in a timely manner and to guarantee the maximum detail and amount of useful information;
• Actively collaborate with institutions to suggest regulatory action to contain the phenomenon [laundering and fraud].

“The work was done with the Postal Police Department of Florence with a Department of Lucca’s Postal Police and has led to the identification of a series of interventions, technicians and garrison,” the section concluded.

The police’s announcement on April 28 stated that the investigation began after investigators gathered enough evidence on the former Silk Road vendor named Kriminale. Police told the press that the raids on the same day occurred because they collected enough evidence for a successful arrest. They successfully arrested Kriminale along with another prominent darknet vendor.

“We conducted an investigation into IDC, supported by technical activities and the use of undercover agents,” Marco Cadeddu, a Lecco Police department head. “We have identified sites and forums that offer […] drugs of various kinds, cocaine, heroin, hashish and synthetic drugs and weapons, forged documents, accounts of e-commerce sites payable to non-existent people or the subject of identity theft, as well as ransomware.

One of the arrests was that of an individual with a connection to IDC yet sold, in a sense, nothing on the marketplace. Officials released little information about the investigation, even at the press conference. However, compared to even the unnamed vendors, this entity barely existed. Police called him a “clandestine banker.”

They referred to an Italian that lived in Bergamo at the time. This clandestine banker, referred to by some sources as a part of a “clandestine banker organization,“ operated a Euro–Bitcoin exchange. Some wrote that he was “in charge” of the site’s money laundering, rather than a completely independent money launderer. Authorities charged him with money laundering and the unlawful practice of financial intermediation.

He operated under the profile “Ghibli, or, ”the banker.” The officially reported number of arrests and warrants mismatch those reported unofficially, but officially, he was a one of the more prominent members of the Italian Darknet Community. Police reported three arrests that day, and all of Italian origin. The news, along with reports from the prosecutor’s office, indicate that police arrested five: three Italians, an Albanian, and a Brazilian. Furthermore, law enforcement announced that they searched 45 locations—alternative sources claimed that police searched 50 and had search warrants for ten suspects.

We know of only three confirmed arrests from the investigation, including banker’s arrest. Law enforcement released near-nothing on anyone arrested. However, the authorities announced that they intended to continue with the investigation. Special attention was shown to the possibility of connecting these crimes with foreign ones or simply other IDC members. Until then, the public may remain in the dark.