FF: Could you start by telling us a bit about your background in law enforcement and how you ended up as an Investigator at Chainalysis.
I don’t remember a time when I didn’t want to join the police! I was the stereotypical young child playing police dress-up, and now, looking back, I do feel proud that I was able to fulfil that childhood ambition. My first role in law enforcement came soon after leaving university, when I joined Cheshire as police staff in the Criminal Justice Unit, before moving over to the National Crime Agency (NCA). There I was based within the International Bureau on the Interpol UK desk, which was a fantastic experience of global law enforcement and working with international partners.
However, I knew that I still wanted to join the police, and in 2016, I re-joined Cheshire as an officer through the Police Now programme. I spent several years on frontline response and neighbourhood roles, before really finding my passion within the Cyber Crime Team. I didn’t have a computer science or technical background but loved the challenges of tackling cyber crime. I soon developed a keen interest in cryptocurrency investigations, and over the years, as my interest and knowledge grew, I knew I wanted to work specifically in this field. Working alongside Chainalysis as a detective, using Reactor on a daily basis etc., meant that for me, joining Chainalysis was my ultimate aim, and I feel incredibly fortunate to be here.
FF: Can you walk us through a typical working day at Chainalysis?
Well, I’ve been here for just over three months now, so I’m still finding my feet and settling in, but I’m thoroughly enjoying life at Chainalysis. We have many elements to the business, and I’ve found the work to be very varied. In my role as an Investigator, I help a wide range of customers with any enquiries or investigations they may have. Due to the very nature of blockchain investigations, these requests can vary in complexity and also crime type, including fraud, hacks and money laundering to name a few.
FF: What are the typical challenges you face when analyzing blockchain data in forensic investigations?
There are a number of challenges that come with blockchain investigations, often requiring varying degrees of skill and expertise. One of the most common and well known challenges that investigators face is the use of cryptocurrency mixing services, often referred to simply as ‘mixers’. Whilst there are many different mixers as well as mixing techniques, in brief mixing serves to break the traceable link between the input and output to a transaction. Sometimes investigations may encounter funds that have gone through several ‘rounds’ of mixing, making the challenge of tracing the correct output even more difficult.
We’ve also seen a rise in the use of privacy coins over the past few years, with perhaps the best known examples being Monero and Zcash. Privacy coins are cryptocurrencies that have privacy-enhancing features built into their protocol, deliberately designed to stop investigators from being able to trace the flow of funds.
FF: The UK’s National Crime Agency (NCA) and the US Department of Justice (DOJ) recently announced the disruption of Lockbit, a prolific Ransomware-as-a-Service (RaaS) group. How did Chainalysis data contribute to this effort?
We work in partnership with law enforcement colleagues globally to ensure they have access to our tools, investigative expertise and training. Collaboration with such agencies is key to operational success, and we’re proud to support them in their respective missions to identify flows of illicit funds and services and actors involved in the facilitation of such criminality.
We’re proud to share that the NCA used Chainalysis tools in carrying out their investigation. In this blog post, we talk more about the unique position Lockbit occupied within the ransomware ecosystem and why this action was important.
FF: Chainalysis recently released a report on crypto crime. Can you tell us about some of the key findings?
Our 2024 report on crypto crime trends reveals a decline in illicit activity, marked by a drop in the value received by illicit entities to an estimated $24.2 billion in 2023, after all-time highs in 2022 of ~$39.6B. In addition to the reduction in absolute value of illicit activity, our estimate for the share of all crypto transaction volume associated with illicit activity also fell, and remains below 1% of all transaction volume.
Also, as the overall use of stablecoins has increased, so has the illicit use of them. Stablecoins now account for the majority of all illicit transaction volume. Transactions with sanctioned services and services in comprehensively sanctioned jurisdictions drive this trend.
FF: What advice would you give to someone looking to enter the field of blockchain analysis and digital forensics?
I’ll certainly speak for my own journey into blockchain investigation, although I’m sure some of this may relate to digital forensics too. The main piece of advice, especially regarding blockchain and cryptocurrency investigations, is not to become overwhelmed and feel as though you need to learn everything at once. This area of work is incredibly diverse with some very complex elements, and it’s almost impossible to become an expert at all elements of cryptocurrency, such as trading, engineering, investigations etc.
For someone looking to start out, I’d recommend learning the real basics of blockchain technology and essentially ‘how it all works’. The Chainalysis Academy, which is free and available to the public, is a brilliant resource and breaks down topics into manageable chunks, which means anyone can find out more about this area without having to commit any time and money upfront. Personally, I found a lot of the guidance and material out there was mainly focused on cryptocurrency trading and investing, which for someone looking to move into blockchain investigation certainly isn’t the best place to start.
Once you feel comfortable and have a solid understanding of how different blockchains work, I’d then start to look at the investigation element of cryptocurrency. This could be around how assets can be traced, what evidence a suspect may leave when moving funds, and the different ways in which a suspect could look to move, hide or convert any funds. There are many free resources and courses available, but try to avoid the numerous investing and trading ones, especially to start with!
FF: While working with Cheshire Police, you were part of an investigation into stalking which featured on the BBC documentary ‘Stacy Dooley, Stalkers’. Tell us about this case and the role digital forensics played in securing a conviction.
This case was both a challenge and a highlight of my policing career. In brief, the victim reported to police that she was being stalked by her then-work colleague. This started off in person and whilst at work, however the stalking behaviours then moved online after the victim was forced to leave her workplace; this is often referred to as ‘cyber-stalking’.
The victim was subject to a whole host of traumatising incidents, including having her online accounts and emails hacked into, and having items sent round to her address, to name just a few. The suspect would also repeatedly make false social media accounts with upsetting names, messages and pictures, and then contact the victim and her friends.
We managed to identify the suspect, who was arrested during a search warrant of his address, where we recovered numerous devices. This is where digital forensics then played a huge part in the investigation. Through the extraction of data from the devices, we were able to conclusively tie the suspect to many of the incidents, including the repeated hacking of the victim’s accounts and the use of the malicious online profiles. We also found evidence that both we and the victim were previously unaware of, where the suspect had attended at the victim’s home address and taken pictures. This all eventually led to the suspect pleading guilty, at which point he received a custodial sentence of two years and eight months.
FF: And finally, what do you enjoy in your spare time?
I love traveling and seeing different parts of the world. I’ve still got lots of places to tick off the bucket list. I’ve planned a road trip around Iceland, so my partner and I are hoping to do that next. We also have a little dog who we rescued over eight years ago, who despite now being over 12 years old, still loves his long walks!
I’m a big sports fan. I’m really into American football, which I even used to play back at university. I also enjoy football and rugby league, although the past few years have been rather painful to watch…
I do like cooking, too. I was bought a pizza oven a while ago, so I’m still trying to get the perfect dough recipe… really rock’n’roll!
