Meet Ramin Sawal, LATAM Director of Law Enforcement Relations and former U.S. Secret Service Special Agent

With a wealth of experience in electronic and financial crime investigations, Ramin focuses on being a trusted resource to our law enforcement partners in Latin America, offering guidance on virtual currency investigative infrastructure and providing investigative leads, training and case specific assistance. 

Prior to joining TRM, Ramin’s career was dedicated to public service. During his 20 year tenure with the U.S. Secret Service, Ramin held roles including Supervisory Special Agent for the Electronic Crimes Task Force in San Francisco, Acting Attaché for the U.S. Embassy in Brasilia and Computer Forensic Examiner. 

We sat down with Ramin – now based in Rio de Janeiro, Brazil – to discuss crypto investigation trends in Latin America and the importance of public-private sector partnerships.

‍How did you get involved in the crypto space and how did you get trained up on crypto investigations? 

My first exposure to cryptocurrency was in January 2017, when I was promoted and transferred to the U.S. Secret Service (USSS), San Francisco Field Office (SFO) to supervise the Electronic Crimes Task Force (ECTF) investigative squad.  

The ECTF was born out of a mandate by Congress (USA PATRIOT Act) to establish a national network to prevent, detect and investigate electronic crimes, including potential attacks against critical infrastructure and financial payment systems.  Over 40 domestic and international ECTFs were established, leveraging the combined resources of academia, the private sector and local, state and federal law enforcement.

At the time, cryptocurrency investigations throughout the USSS were pretty much non-existent, but the USSS-SFO-ECTF investigative squad took an interest in these specific types of cases and initiated multiple investigations, which resulted in multiple prosecutions and seizures of assets.

‍Can you tell us about an interesting case you worked on during your time in the public sector?  

One of the more significant crypto-related investigations I participated in was during my time as Supervisor of the USSS-SFO-ECTF investigative squad.  

The investigation involved two Russian nationals who launched a sophisticated phishing campaign in 2017 and 2018 that targeted customers of two U.S.-based and one foreign-based virtual asset service providers (VASPs).  American citizens and businesses were among the victims of this malicious cyber-enabled activity, which resulted in combined losses of approximately $17 million U.S. dollars .  

The attackers created numerous web domains that mimicked those of legitimate virtual currency exchanges.  This tactic, known as spoofing, exploits internet users’ trust in known companies and organizations to fraudulently obtain their personal information. 

When unwitting customers accessed the spoofed websites and entered their login information, the attackers stole their login credentials and gained access to their real accounts.  The attackers then employed a variety of methods to exfiltrate their ill-gotten virtual currency by using exchange accounts created using fictitious or stolen identities; circumventing exchanges’ internal controls; swapping into different types of virtual currency; moving virtual currency through multiple intermediary addresses; and a market manipulation scheme in which inexpensive virtual currency was purchased at a fast rate to increase demand and price, then quickly sold for a higher price to gain quick profit.

The stolen virtual currency was subsequently traced to the attackers’ personal accounts, and millions of dollars in virtual currency and USD were seized in a forfeiture action by the USSS-SFO-ECTF.  Ultimately, both Russian actors were indicted and sanctioned alongside several wallet addresses by the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC).

What are the key crypto investigation trends and typologies we are seeing in Latin America?

The popularity of crimes involving cryptocurrency has exploded throughout the LATAM region recently, with the most popular types of crypto-related crimes including money laundering, ransomware, investment/Ponzi schemes, extortion, and romance scams.  

With law enforcement already having to spend a substantial amount of time addressing “traditional” financial crime risks , investigating complex technological crimes becomes even more difficult. Moreover, with violent crime posing a major issue in the region, law enforcement assets are most often directed towards these types of crimes rather than crypto-related offenses.

With this in mind, providing training and continuing to be a resource to our LATAM partners in relation to crypto investigations is essential.  

‍What is an essential piece of advice you would give to someone in the public sector in the early stages of implementing a process for investigating crypto cases?

Invest in training for your investigators and create partnerships with law enforcement agencies, prosecutorial offices and crypto businesses to be able to work together in addressing these types of investigations.

You mentioned partnerships- could you tell us about a successful partnership you have either been involved in or witnessed in this space? 

When I managed the SFO-ECTF, it was the largest in the USSS with over 2000 members, who were primarily based in tech-savvy Silicon Valley, California.  Public and private sector entities, as well as academia would come together with local, state and federal law enforcement to train, exchange ideas and best practices and ultimately work together to solve complex cyber investigations.

Since joining TRM Labs in August 2022, I have been involved in numerous public-private sector partnerships, including TRM’s Project Leo Working Group, which was created by TRM to develop best practices, facilitate collaboration and discuss strategies for making the crypto space safer.  Domestic and international law enforcement from local, state and federal agencies participate in the working group.

What makes you most excited about bringing TRM’s tools to partners in the LATAM region? 

According to research conducted in 2022 by the Economic Commission for Latin America and the Caribbean, the fastest growing region in reference to crypto adoption and the region with the most crypto users per capita in the world is LATAM.

Cryptocurrency adoption has become a necessity within the region, due to a combination of out-of-control inflation, depreciating local currency values, and the sending of remittances. Moreover, approximately 70% of the population is unbanked, without bank accounts or credit cards, meaning that crypto provides an opportunity to bring more people into the formal economy. 

Working with TRM means that I can dedicate my time to making the crypto space safer for the 700 million residents of the region by assisting law enforcement and prosecutors to bring bad actors to justice, which is incredibly rewarding. 

Interested in a role at TRM? See our current openings here.

‍