Alternative payment apps such as AliPay a boon for cybercriminals, experts tell Congress

Experts warned members of Congress against a myopic focus on the illicit role of cryptocurrencies, instead pointing to how payment apps developed in China and Russia pose a national security threat.

“Focusing only on cryptocurrency risks misunderstanding this global, thriving ecosystem,” Scott Dueweke, global fellow at the Wilson Center, told members of the House Financial Services subcommittee on National Security, International Development, and Monetary Policy on Tuesday.

Dueweke pointed to the use of payment apps such as China-based Alipay and Russia-based Qiwi, which Russian actors used to purchase Facebook ads to influence the 2016 presidential election. “The nexus between adversarial illiberal regimes and cybercrime cartels acting as their proxies using these systems is clear,” he said.

Other witnesses also raised concerns about alternative payment apps.

“In many instances, it is actually in fact easier to investigate cases involving the illicit use of cryptocurrencies than other traditional means of payment or some of the alternative payment systems that we’re talking about,” said Jonathan Levin, co-founder and chief strategy officer of Chainalysis, a cryptocurrency tracing firm that works extensively with the U.S. and other governments.

The hearing on the national security implications of alternative payment systems comes as rivals such as China and Russia work on their own version of a digital dollar that can evade global financial regulations.

“These systems each pose unique challenges that will require U.S. regulators and the international community to refine our sanctions strategies, closely monitor worldwide financial trends and keep pace with the rapidly evolving payment ecosystem to make sure that we are not caught flat-footed,” said subcommittee chairman Rep. Jim Himes, D-Conn.

Levin urged the U.S. government to use new technologies to be more “proactive” in monitoring financial crimes instead of solely relying on sanctions and seizures. “We need to charge our executive branch with, ‘How do you do that proactively in an age where this information is out there online?'” he said.

Another way the U.S. can prepare for such risks is to increase law enforcement training and tools for blockchain-related investigations, said Ari Redbord, head of legal and government affairs at TRM Labs, another cryptocurrency tracing firm.

“The reality is we’ve never had more visibility on financial flows,” said Redbord, a former federal prosecutor and advisor at Treasury Department. He pointed to arrests earlier this year of two individuals involved with laundering funds stolen in a 2016 hack of virtual currency exchange Bitfinex.

The hearing follows the release on Friday by the Biden administration of a comprehensive national framework for securing digital assets. As part of the framework, the Justice Department announced the establishment of a national network of more than 150 designated federal prosecutors focused on crimes linked to digital assets, such as cryptocurrency.

The DOJ also issued a report with suggestions on how to enhance law enforcement’s ability to investigate and prosecute such crimes. The department expressed support for regulations that would facilitate investigations, such as enhanced customer identification and anti-money laundering efforts.

Rep. Anthony Gonzalez, R-Ohio, questioned witnesses about recent sanctions of mixer Tornado Cash, a move that set off a firestorm in the industry and recently led to a lawsuit against the Treasury Department.

“It is actually possible to seize funds on the other side of a mixing service,” Levin said when asked if it was still possible to conduct law enforcement oversight after virtual currencies go through a mixer. “It’s not always possible but it’s not always impossible.”

Redbord noted that there are a number of legitimate reasons why a U.S. individual would want to use a mixing service.

“In a world in which transactions are happening more and more on open blockchains, people are going to want a level of privacy,” he said. “On the one hand, I think regulators are focused on going after illicit actors who are using these types of services. On the other hand, they should ensure that regular users are not being affected.”