Casey Dougherty

Take us through your background in the USSS, and the type and scale of cases you worked. How did you get into crypto investigations?

I spent 13 years in US federal law enforcement before joining TRM. For much of that time, I was a special agent with the US Secret Service, primarily working cybercrime investigations. Over time, the volume of financial cases with a crypto element grew until it seemed nearly every case on that track led to crypto. As part of a Secret Service Cyber Fraud Task Force, I collaborated with state, local, tribal, territorial and other federal law enforcement agencies, as well as prosecutors, private industry and academics, on digital forensics and incident response cases.

Having personally dabbled in bitcoin mining since 2010, I naturally gravitated towards cryptocurrency tracing. At first I used open-source explorers, spreadsheets – and even Microsoft Paint(!) in the early days – before tracing software became available.

What cases have you worked that particularly stand out? How has your caseload evolved in recent years?

In my law enforcement days, I was fortunate enough to work on dozens of crypto-related scams and fraud cases. Being able to return the life savings to an elderly victim who has fallen prey to a scam is extremely gratifying and is the reason we all do what we do.

I continue to work fraud and scam cases now. Just recently, I prevented an individual from falling victim to an attempted crypto romance scam, by educating them on how to recognize red flags and the likely techniques the scammers would use. Crypto crime touches every corner of America and leveraging tools like Chainabuse allows victims and law enforcement to find each other quickly, maximizing the chances of fund recovery.

My caseload at TRM also includes investigations into some of the largest financial losses ever seen in crypto-related criminal cases. And, since the tactics used by criminals evolve at a blistering pace, I have become involved in smart contract exploits and “rug pull” investigations, which I was not exposed to previously. When we are able to discuss these cases publicly, we will – stay tuned for case studies!

How easy is it to combine digital forensics and blockchain analytics to extract meaningful intelligence?

I am fascinated by the intersection between cryptocurrency investigations and digital forensics. Combining the two disciplines to identify artifacts on digital devices and then transpose them onto the blockchain allows us to understand what criminals do with their ill-gotten gains.

As tools become both robust and user-friendly, investigators are finding more and more crypto angles in cases that they were previously unaware of. With rising awareness of how valuable crypto evidence can be in an investigation, we are better able to follow, freeze and seize funds, disrupt criminal enterprises and locate more victims that were previously unknown to law enforcement.

TRM Forensics is a good example of a tracing tool that is intuitive for beginners and sophisticated enough to satisfy seasoned cryptocurrency investigators. My favorite features include its ability to trace cross-chain swaps and to visualize financial flows on a single graph, irrespective of how many blockchains are involved.

What is the biggest challenge facing crypto investigators right now? How can it be overcome?

Without a doubt, education. There are thousands of incredible investigators who work tirelessly for victims of all types of crime. The problem is many agencies don’t have investigators who have been trained and/or comfortable working crypto cases. Those that are tend to be self-taught out of curiosity or necessity.

Though crypto-related and traditional financial crime share many characteristics, there are unique and more technical aspects surrounding crypto that require additional understanding. Thankfully, the number of resources available is steadily increasing and the community of experienced crypto investigators is growing. TRM Academy is contributing to that effort via the range of training and certification courses it offers – both for newcomers to crypto and more experienced investigators.

Additionally, having access to TRM’s team of experienced crypto investigators all around the world is an extremely valuable resource. Speed bumps occur in every investigation, but knowing where to turn for help can get the case back on track very quickly. As former law enforcement professionals, TRM’s investigators are familiar with our partners’ procedures and investigative needs. For example, we know the challenges of justifying in an affidavit how and why we know what we are writing down. Attaining probable cause is a far cry from simply “identifying” a culprit and posting their identity online.

What have you learned recently from a Global Investigations teammate?

I recently learned of a change to the way certain wallet software stores addresses and the seed phrase associated with it. This discovery has allowed me to modify existing digital forensics tools to locate more valuable artifacts and filter out false positives.

I’m also currently exploring the capabilities of smart contracts, and how to dissect changes made to these contracts when used fraudulently. Fortunately, Global Investigations has some members who are very well versed in this area, and I’m gleaning new information from them every day!