Emma Henshaw

How did you land at SEROCU, and is there a particular case from your time there that stands out?

My investigative journey started in 2011, when I joined the UK’s Surrey Police as a “fast-time” intelligence researcher, overseeing such areas as  kidnappings, firearms and threats to life. The role was a baptism of fire – I covered all manner of crimes and I never knew what was coming next. It taught me first-rate open source intelligence skills and how to quickly synthesize large quantities of information into easily digestible intelligence briefings for decision-making officers.

When I transferred to SEROCU’s cybercrime division in 2014, I started working end-to-end crypto investigations. 

I developed deep expertise in drug crime linked to darknet markets; these investigations became my bread and butter. In late 2017 I was among the first to give evidence around cryptocurrency analysis in relation to a UK darknet drugs case. It led to a 16-year prison sentence for a Portsmouth-based drug dealer who sold ecstasy tablets for bitcoin on the dark web.

What other interesting cases did you work on, and what makes them so memorable?

Several of the cases I worked at SEROCU required close collaboration with domestic and/or international private and law enforcement partners. For example, I worked on one of the UK’s largest-ever darknet drugs cases into the production and supply of counterfeit pills, including Xanax, worth more than GBP 20 million.

I worked on one of the UK’s largest-ever darknet drugs cases into the production and supply of counterfeit pills, including Xanax, worth more than GBP 20 million.

The drugs were produced in the UK at low cost using raw materials imported from China, and sold in the UK and abroad using cryptocurrency on the darknet. During the five-year-long investigation, SEROCU worked closely with Pfizer Global Security, which previously manufactured Xanax and had begun its own probe into the matter in 2016.

I also collaborated with Europol and German police from the state of Hesse on a complex investigation into the theft of more than GBP 2 million in cryptocurrency by an Oxford-based Dutch academic. The individual had set up a website that scraped its customers’ wallet credentials over several months. He then stole their assets, moving them through a web of trading accounts.

Most crypto investigators say the learning curve never ends. What have you learned recently?

During my time with SEROCU, my expertise focused on what was dominating the UK cybercrime landscape – that is, pure cyber investigations, often linked to darknet markets. However, on joining TRM, I encountered a much broader spectrum of criminal typologies and embarked on a steep learning curve.

Before long, I gained expertise in hacks and social engineering, bridges, financial exploits – areas that I was not exposed to in the past. In this, I was greatly supported by TRM’s team of investigators around the world, each of whom has their own specialist areas of expertise.

At TRM, what is the most impactful way you support law enforcement?

One of the most impactful ways my colleagues and I support law enforcement is by being retained by investigative agencies to author expert witness reports for use in court proceedings. This occurs, for example, when agencies have used various different tools on a crypto-related case and they’ve been summoned to present the evidence supporting their investigation.

One of the most impactful ways my colleagues and I support law enforcement is by being retained by investigative agencies to author expert witness reports for use in court proceedings.

I also provide other kinds of proactive and reactive support, from helping identify matters for investigation and ways to progress existing cases to assisting with TRM’s software.

It helps that, besides technical crypto knowledge, TRM’s global investigators are well acquainted with the realities law enforcement agencies face around the world. We understand their investigative priorities, resourcing constraints and what they might find useful, helpful and interesting.

You are often asked about your experience of testifying in crypto cases. What’s your top tip for investigators?

Understand what tools are telling you, not just how to use them. At the end of the day, an investigative tool is really an aid to help convey complex concepts to your audience. The investigator must first have a thorough understanding of the underlying concepts to use a blockchain tracing tool effectively. In the Xanax investigation, for example, in addition to using software to conduct clustering – deanonymizing blockchain data and linking wallets belonging to the same user – I also manually traced 4,000 transactions and over 700 cold addresses to ensure that nothing was missed. Defense expert witnesses really scrutinize and challenge your work, as they have every right and obligation to do, and you have to be prepared to respond. Though labor intensive, my analysis was robust and meant that I would have been able to explain my workings in court.

I’m a big fan of the way we design the courses for TRM Academy, with a focus on tool-agnostic concepts above all else. The courses are taught by experienced investigators who know that tracing software is only one piece of the puzzle.