Virtual Villainy
© 2010 FrontLine Security (Vol 5, No 2)

‘Within three to five years, Al-Qaeda will be utilizing the Internet and mobile phones to centralize their fundraising.’ This sobering assessment from Richard Barrett of the United Nations is a stark reminder of the threat posed by terrorist use of developing technologies – the virtualization of terrorism.

Indeed, the past decade has served as a case study into the ability of terrorist groups to seamlessly evolve from the real-world battlefields of the Middle East and North Africa to their virtual counterparts on the World Wide Web.

Although groups like Al-Qaeda have consistently adapted to changing technologies, the Internet’s ease of access, fast flow of information, anonymity of communications, and dearth of regulations have revolutionized the command and control structure of modern terrorist organizations. While individuals such as Younis Tsouli, Abu Monsoor al Amriki, Anwar al-Awlaki, and Coleen LaRose have dragged international terrorism’s propaganda, planning, and recruitment apparatus into the 21st century virtual worlds of the Internet, more ominously, the financing of terrorist operations may be shifting there as well.

The Evolution of Terrorist Financing
Preventing the free flow of money to international terrorist ­orga­nizations has been a prime objective in the war on terror. However, as authorities have cracked down on the abuse of banks, credit unions, and other formal institutions, terrorists have shifted their operations to Hawalas and similar underground banking systems; what the Council on Foreign Relations calls “those places with ­limited bank supervision, no anti-money laundering laws, ­ineffective law enforcement, and a culture of no-questions-asked bank secrecy.”

Virtual worlds provide many of the same characteristics of the existing underground network – they are fast, inexpensive, reliable, convenient, and most notably, discreet. Moreover, financiers no longer need to leave the comfort of their own homes to successfully transfer large sums of money to those looking to carry out horrific attacks. Consequently, while law enforcement officials have achieved successes in regulating the formal financial sector, virtual worlds remain open to business for terrorist dollars.

Virtual worlds are computer-based, simulated environments where millions of users can interact with each other on a daily basis. Users simply download the software to run the program, sign up for a free account, and log in to a world where they are represented by a virtual depiction of themselves known as an avatar. Because these virtual worlds are meant to reflect the real world, many have developed robust ‘virtual economies,’ allowing users not only to connect with new people and old friends, but also to buy, sell and trade goods using e-cash that has real world value. With limited ­regulation or observation by law enforcement, virtual worlds are ­fertile ground and ripe with opportunity for terrorist financiers.

The primary challenge is the paltry customer identification rules associated with virtual worlds. In traditional banking, customer identification procedures are implemented both during origination of accounts and during individual transactions. However, due to the nature of virtual worlds, the ability to accurately identify customers is limited at both of these stages, making them more vulnerable to financial crimes.

Despite these vulnerabilities, without a documented instance of virtual terrorist financing, the methodology remains largely ­academic. However, by combining the recognized vulner­abilities of virtual worlds with the known traits of terrorist financing, it is possible to construct the following hypothetical ­terrorist financing scheme in a developing virtual world (VW):

Over the course of two weeks, 15 individuals in five cities in the United States register to join VW from local coffee shops and internet cafes. After downloading the required programming, these users are prompted to register. Although all of them are men from random countries throughout the Middle East, Southeast Asia, and Northern Africa; they all supply nondescript anglicized names and about half self-identify as female. In order to confirm their identity, they then provide the free web-based email address that they had set up the day before from another coffee shop. After confirming their new virtual accounts, all of the men shut down their email accounts and allow their newly created VW accounts to remain dormant for the remaining time in the two-week period.

With their accounts set up and avatars selected, all 15 individuals begin the task of blending into their new virtual world. They go to social functions and meet other avatars; and looking to ­capitalize on VWs virtual economy, five of them open in-world businesses. One acts as a virtual real estate broker, one sells virtual lingerie, another runs a virtual coffee shop, and two others run stores that transfer real world books and paintings respectively. In order to handle the expected demand for the virtual and real world products that their avatars are selling, each of these businesses hire two staff members who applied by contacting them and providing a pre-approved code word. With their businesses set up, the avatars go about their every day in-world business, selling their wares and making VW$.

Two months after initially setting up his account, and having given the other 15 residents time to get settled in their new businesses, a 16th avatar begins to customize his new virtual life. Having spent the past eight weeks converting $500 per week into VW$ from a PayPal account, this avatar now has VW$4,000 available. Over the course of one week, that avatar then goes about engaging in the following transactions with the aforementioned businesses: he purchases a virtual island home for VW$1000, of which the real estate broker takes a commission of 50%; he buys VW$200 worth of lingerie for his virtual girlfriend; each day he purchases three cups of virtual coffee for VW$5 per cup, for a total of VW$75; and with the remaining money he purchases countless books and paintings, none of which are ever delivered despite the transfer of VW$. Within nine weeks the initial VW$4,000 has been transferred out and into the accounts of the other fifteen avatars. Each of them then exchanges the VW$ back into real world currency through PayPal and prepaid debit cards, and cancels their VW accounts.

Back in the real world, the individuals gather in groups of three in all five of the cities. They combine their funds and are left with a little under a thousand dollars per group. They immediately work towards implementing their ‘mission,’ purchasing the material and creating one improvised explosive device per person. By the end of the week, and less than three months after first signing onto VW, the men carry out 15 suicide bombings in five major cities throughout the United States. Without the ability to identify or trace the source of the funds or the avatars that financed these attacks, law enforcement and intelligence officials are left with ­limited leads in investigating the attacks.

As this hypothetical demonstrates, the use of virtual worlds to finance terrorist attacks is far from merely academic.

Regulating the Virtual Hawala
The environment in which terrorists raise, launder, and transfer funds to further their activities remains all too permissive. The complexity and variety of methods available to terrorist financiers, combined with the difficulties of identifying these otherwise innocuous financial transactions, requires broader regulation and enforcement. In particular, the ability of terrorist financiers to move between the formal and informal financial sectors must be curbed, and any policy aimed at doing so must be all-encompassing to have any chance of successfully disrupting terrorist activity.

At the forefront in the global war on terrorist financing is the Financial Action Task Force (FATF), an international body dedicated to the eradication of money laundering and terrorist financing. The FATF has led the charge for greater regulation and accountability, offering a list of 40 recommendations that should be implemented by those in both the formal and informal financial sectors worldwide. Of all the recommendations, those that are considered integral to developing successful programs to combat terrorist financing include:

  1. the identification of all individuals and businesses engaged in financial transactions, both formal and informal;
  2. accurate and verifiable information through which customers can be identified; and
  3. maintaining records of all financial transactions and reporting those identified as suspicious.

While participating countries have implemented many of these ­recommendations, loopholes remain.

Recognizing this vulnerability, measures should be taken to effectively curb the use of new underground banking by terrorist organizations. The most effective way of reducing the potential for abuse of virtual economies is to refine the scope of coverage and to clarify that virtual worlds that allow for the transfer of money and other things of value are covered institutions. Although virtual worlds may not appear to be traditional ‘financial institutions,’ they can reasonably be covered as a part of the informal financial system. Virtual worlds not only engage in the transfer of funds; by allowing residents to exchange real world currency with virtual currency, they have built a system where the virtual economy is an integral part of the business.

To combat this, virtual worlds must be placed on notice that they are subject to such regulations. They must then begin to implement comprehensive anti-money laundering and terrorist financing programs. Such compliance programs must be required of both formal and informal financial institutions. Expanding them to virtual worlds, while admittedly more complicated, will result in a reduction in the criminal abuse of such systems. A key compliance scheme has been the requirement that all covered institutions ‘know your customer’ – this recognizes the critical role that both formal and informal financial systems play in any effort to find terrorists.

Under existing regulations, covered institutions must:

  1. identify customers as they open accounts by obtaining ­information such as name, address, date of birth, and taxpayer identification number;
  2. exercise reasonable efforts to verify the customer’s identity;
  3. maintain records and information obtained during the ­identification and verification process; and
  4. consult lists of individuals whose assets have been blocked or frozen.

Like their brick and mortar counterparts, virtual worlds must ensure that every avatar with virtual currency can be linked back to a verifiable name, address, and a real-world bank account. Without this basic ‘know your customer’ type requirement, no amount of anti-terrorist financing efforts will be effective.

Implementing procedures for verifying customer identification, while potentially costly and time consuming, is a necessary cost for those looking to profit from the spread of virtual economies. Although this is a developing area of regulation, traditional banks have been implementing similar programs as they have shifted to online banking. This foundation has proven that such regulation is more than feasible.

Roderick Jones, an expert in the use of developing technologies by terrorist groups, has observed that “you didn’t have to speak ­Arabic in the mid-90s to know that terrorism had shifted its focus, and you don’t have to write code to understand it has changed again.” As terrorist financiers shift to unregulated financial sectors, law enforcement officials, and the tools at their disposal, must also evolve.

Efforts to disrupt terrorists’ ability to fund their operations will not succeed if they focus solely on the formal banking or mainstream financial sector. Law enforcement officials must implement a comprehensive counter-terrorist financing policy that will continue to effectively crack down on abuses of the formal financial sector, while implementing broader regulations for developing underground banking mechanisms such as virtual worlds. While this proposal will be neither easy nor popular, to stand idly by and allow the Internet to remain a place where criminals and terrorist groups can anonymously do as they please, is unacceptable.

Stephen I. Landman is the Director for National Security Law and Policy at the Investigative Project on Terrorism, one of the largest archival storehouses of open source intelligence on radical Islamic networks.
© FrontLine Security 2010