COVID-19 and Illicit Finance in the Cyber Domain

The COVID-19 pandemic has caused major economic disruptions and forced large amounts of financial activity online. Illicit actors are likely to take advantage of the rapid shift to digital transactions and virtual business environments, requiring law enforcement and national security officials to address more cyber-enabled operations. Innovations in digital financial infrastructure will likely influence economic, security, and geopolitical trends as nations seek new ways to manage their fiscal and monetary responses to the economic crisis. The United States should not get caught flat-footed as innovators globally experiment with improved online payments and authentication of identity digitally. U.S. policymakers need to closely track how adversaries and competitors, especially China, exploit the crisis to strengthen political power and influence by leveraging financial technology (fintech) to enhance financial surveillance and control. This commentary outlines some of the key trends and risks in the digital financial realm as the pandemic pushes more activity online.

How will the COVID-19 pandemic impact cybercrime?

As long as the pandemic remains an immediate public health concern, cybercrime is likely to proliferate, with illicit actors exploiting both the heightened fears around the coronavirus and the unprecedented rise in internet activity. With more of the public staying indoors, business and recreational activity is shifting from physical locations to online platforms. Longstanding cybercriminal schemes are likely to surface during this pandemic with a COVID-19 twist. But new types of illicit activity, especially targeting remote workers, are likely to emerge that capitalize on new norms from social distancing.

Law enforcement officials are warning of COVID-19-related scams and fraud. The U.S Department of Justice is noting reports of criminals selling fake coronavirus cures online, hackers deploying phishing emails posing as health organizations, and fake COVID-19 websites that infect victims’ computers with ransomware. In the United States, fraud will likely spike while the federal government disburses economic impact payments to individuals, families, and businesses in the coming weeks.

The darknet may enable more illicit financing around COVID-19 in the coming weeks. Europol is warning that if critical coronavirus medical supplies remain scarce at regular websites, trafficking for them may grow at darknet marketplaces. Research on the darknet shows that several vendors are now offering N95 masks and coronavirus diagnostics. Hoarding and price gouging of such equipment already is happening, according to the Department of Justice. Also, Europol is noticing darknet forum members anticipating a rise in online child sexual exploitation activity as predators and victims spend more time exposed to the Internet.

As more organizations, including government agencies, run business and events by video conference even after the pandemic, there will be higher risk of data compromise, economic espionage, and other criminal targeting of participants. Some activities that might only be mildly disruptive in this pandemic could become damaging illicit typologies if criminals adapt them for more nefarious aims. For example, "Zoom-bombing"—where unauthorized persons join video conferences to hijack and vandalize the virtual space—is becoming more common, and may become more malicious and criminal.

What are the pandemic’s implications for cryptocurrency use, illicit or legal?

Criminals already are deploying cryptocurrency scams with a COVID-19 angle. Cryptocurrency analytics firms have identified multiple new digital tokens created around coronavirus themes, some of which are likely scams seeking funds from victims. One token had a website claiming to raise funds for a COVID-19 vaccine and related medical equipment, but the site soon vanished. In one distasteful, though not illegal, endeavor, blockchain developers programmed a coronavirus-themed coin that decreases its supply based on the rise in new daily cases, making it more valuable as the virus infects more people.

Cryptocurrencies will likely be important for financially motivated hackers exploiting the pandemic. Ransomware attackers typically seek payment in cryptocurrencies. Recently, a hacking group attacked a UK medical firm doing coronavirus research, attempting to hold the firm’s research data hostage.

Bitcoin has had tremendous staying power as a speculative asset in its decade of existence, but it seems unlikely that cryptocurrencies will gain greater use beyond speculation in the short-term of the pandemic. In fact, there are signs that cryptocurrencies, long seen as having value uncorrelated to other investment assets, are as vulnerable to the current economic distress as the rest of the financial markets. The price of Bitcoin crashed in mid-March 2020, in tandem with the overall stock market drop in the midst of the COVID-19-induced sell-off. And although public sentiment appears to be growing in support of developing more efficient forms of digital payments, arguments for adopting decentralized, stateless digital currencies do not seem to be gaining more traction than before.

As more financial transactions shift online, what are the ramifications for the wider adoption of financial technologies (fintech) in the United States?

For the U.S. government, the pandemic has laid bare the creaky public infrastructure for disbursing payments. It will be extremely difficult for the Treasury Department to disburse economic impact funds to people who do not use direct deposit when they file tax returns, or who do not file tax returns at all. A number of experts and members of Congress have proposed ways the U.S. government could improve this, including through central bank digital currency or through similar measures, such as direct accounts for payments and government disbursements through the Treasury Department. A number of payments firms have also proposed ways to support the Treasury Department in disbursing economic impact money more quickly. With the technological advancements that the Internet has brought to reshape public life the past 20 years, it is remarkable that most people must wait for days for checks to clear as they did in the 1990s and that the government does not provide real-time payments.

In the private sector, the pandemic is causing a major shift to online and contactless payments as people rely on e-commerce to buy goods and services they might normally buy in person. With many people trying to avoid cash, there is and will continue to be huge demand for digital and contactless payment tools.

With online transactions and virtual interactions now becoming the norm, in the long run both the public and private sectors will need to find better ways to authenticate people’s identities digitally. This will involve not only technical and logistical challenges, but also some very complex privacy, legal, and ethical issues that governments and the private sector will have to address. The Financial Action Task Force (FATF) which sets global standards for anti-money laundering and combating the financing of terrorism, recently released guidance to help governments, financial institutions, and virtual currency businesses assess digital identity technologies. However, FATF only offers standards and recommendations. Jurisdictions will need years to test, evaluate, and implement digital identity solutions, with significant variation across jurisdictions.

The pandemic has elevated the public policy conversation around digital payments and made clear the need for greater adoption of digital financial infrastructure, both by the U.S. government and by the private sector. Today’s cumbersome payments system is a threat to individuals and to U.S. national security. Low and middle-income individuals with lesser access to cash saving will be most in need of rapid financial relief from the pandemic’s economic disruption. A quicker and more streamlined payments system will help ensure the United States is able to respond to other unforeseen economic crises that may arise in the future.

Governments around the globe are exploring the possibility of creating central bank digital currencies. How will the pandemic influence these developments?

The pandemic will almost certainly accelerate exploration of CBDCs by central banks around the world for various reasons. A number of countries, including China and the United States, are taking action to clean or replace existing cash in order to address concerns that physical cash may transmit the coronavirus, although there is not clear evidence that cash poses a serious transmission risk.

Even prior to the pandemic, a number of central banks were experimenting with CBDC. This research is likely to receive greater focus as central banks become more concerned with increasing citizens' access to money and strengthening monetary policy responsiveness in a difficult global economic environment. Facebook’s announcement of Libra in 2019, along with broader increased interest in digital payments, has already significantly increased the urgency of research into CBDCs out of concern that a global stablecoin like Libra could interfere with central banks’ ability to carry out monetary policy.

According to a Bank for International Settlements (BIS) survey, among major advanced and emerging economy central banks surveyed, 80 percent are engaged in some level of research in CBDC, up from 70 percent in 2018. Nearly 10 percent of surveyed central banks have moved beyond theoretical research and are in the process of implementing pilot CBDC projects. In Europe, the European Central Bank (ECB) recently developed a proof of concept for an anonymity-preserving CBDC and has also outlined how a CBDC could be structured. The Bank of England recently put out its own paper proposing consideration for the design of a CBDC and requesting comments.

The Chinese government also appears to be accelerating its CBDC development as a result of the pandemic. A number of Chinese officials have indicated that China is encouraging further adoption of digital payments and specifically looking to speed testing of its CBDC. Officials at the People’s Bank of China (PBOC) previously stated that they plan to test a pilot version of the CBDC in two cities this year, and the Agricultural Bank of China, one of China’s largest banks, just recently revealed an interface for the CBDC it is testing in four cities.

What are the economic and national security implications of China’s digital currency push?

China’s development of CBDC has outpaced most other countries, raising concerns from U.S. national security policymakers that a digital renminbi will threaten U.S. economic security and the role of the dollar over time, while also increasing China’s financial surveillance and control capabilities. While the threat of a digital renminbi to the role of the dollar is greatly overstated, there are two immediate security policy concerns with China’s CBDC development. First, it increases the Chinese Communist Party’s authoritarian hold over its population. PBOC officials have said they are designing a CBDC so that it has “controllable anonymity.” This would give the Chinese government more robust financial surveillance capabilities, including potentially the ability to more directly censor payments not in line with party directives. Beijing, along with many other capitals, has already dramatically ratcheted up its surveillance tools and activities in response to the pandemic.

Second, China’s lead in developing and implementing a CBDC may give it influence in setting standards and providing technical assistance to other countries as they develop their own CBDCs. The United States, and its allies and partners, should not dismiss China’s CBDC development and should accelerate work on various CBDC or other digital payment options with strong privacy protection. If China drives the development of CBDC standards, and promotes technical features enabling greater authoritarian surveillance and censoring of financial activity, then financial privacy and political freedoms in many countries will suffer.

At the same time, a fully operational CBDC alone would not give China the economic conditions to displace U.S. global financial influence. The renminbi—digital or not—is not likely to become an international reserve, especially while China has stringent capital controls and a shallower and much more fragile financial system than the United States. Still, U.S. policymakers should closely study and track China’s progress along its digital currency roadmap. It is an indicator of a broader long term strategy by China and other U.S. adversaries attempting to offset the power of U.S. coercive economic tools such as sanctions, investment restrictions, and trade controls.