Safeguarding the evidential value of forensic cryptocurrency investigations. (June 2020)

• Record Type: Journal Article
• Authors: Fröwis, Michael; Gottschalk, Thilo; Haslhofer, Bernhard; Rückert, Christian; Pesch, Paulina
• Is Part Of: Forensic science international. Volume 33(2020)
• Publication Date: 2020-06
• Subjects: Digital forensics -- Cryptocurrencies -- Digital evidence -- Safeguards -- Legal
• DOI: 10.1016/j.fsidi.2019.200902
• Languages: English
• ISSNs: 2666-2817

Abstract

Abstract: Analyzing cryptocurrency payment flows has become a key forensic method in law enforcement and is nowadays used to investigate a wide spectrum of criminal activities. However, despite its widespread adoption, the evidential value of obtained findings in court is still largely unclear. In this paper, we focus on the key ingredients of modern cryptocurrency analytics techniques, which are clustering heuristics and attribution tags. We identify internationally accepted standards and rules for substantiating suspicions and providing evidence in court and project them onto current cryptocurrency forensics practices. By providing an empirical analysis of CoinJoin transactions, we illustrate possible sources of misinterpretation in algorithmic clustering heuristics. Eventually, we derive a set of legal key requirements and translate them into a technical data sharing framework that fosters compliance with existing legal and technical standards in the realm of cryptocurrency forensics. Integrating the proposed framework in modern cryptocurrency analytics tools could allow more efficient and effective investigations, while safeguarding the evidential value of the analysis and the fundamental rights of affected persons. Highlights: Analyzing cryptocurrency payment flows has become a key forensic method in law enforcement. The evidential value of obtained findings in court is still largely unclear. We discuss commonly used methods in cryptocurrency investigations in the light of internationally accepted legal standards. Furthermore, we translate the findings into a data sharing framework to safeguard the evidential value of the findings.