Investigating Digital Facilitators of Crime to Link Criminal Networks

Summary: When criminal enterprises make use of an individual within their organisation to facilitate the creation of websites and other digital services, it is possible to link all of the businesses registered by that person, enabling the further identification of both people and businesses involved in a larger scale criminal network.

During a recent training session, we looked at a particular person wanted by the police within the UK.

After spending some time looking at their ‘legitimate’ business (a suspected front for moving goods and money laundering), their social media, public business records, and their wider digital footprint, we were able to locate a recent address abroad for the wanted person, based on recent social media photographs.

However, we decided to continue the digital investigation and look at accomplices and the wider network of criminals associated with the wanted person. The ‘legitimate’ business they owned prior to vanishing had a website, let us call it ‘County Linear’ (not the real business name). County Linear was formed (according to Companies House) in 2016, and their website was set up using a domain name of the same name, also registered after this date in 2016.

Looking at the public registration data for this domain, it was not registered by the wanted person, but by another third party person (we’ll call him Mr. Domain) - and we could also look at other domain names registered by this person. There were quite a few domain names registered, and this allowed us to look at the websites that had historically used these domain names. In other words we could see the business websites that this third party person had enabled, through the domain name registration.

Many of these businesses were in a similar industry to County Linear, the business our wanted person owned - and many of the products legitimately sold by County Linear were acquired from abroad. But many of the businesses Mr. Domain purchased domain names for were also concerned with importing and exporting (typically listing that their specialism was importing the very raw products that were sold in companies such as County Linear). In fact, many of these firms were set up sequentially - for example, an import agency set up in 2011 was dissolved the following year, and then another took its place - a process that continued for several years - during which time, very few official accounts were submitted to HMRC. These businesses had ties to countries in Europe, and people in Asia. They also pointed to business registrations in Delaware, USA (a notoriously secretive US state for business registrations).

The websites that existed alongside these businesses were few and far between, and they seemed to exist without publicity or marketing. However, we did find that Mr. Domain, also had an email address that related to one of these import/export companies. He often used this email address in the registration of further domains for other import/export businesses.

Looking at the official records of these businesses, we can see who was the most prominent director, and who held the most shares. Two men from the UK in particular stood out as having an involvement in almost all of the import/export businesses. Companies House data also provided details of other companies they are, and have been, involved with.

Using the Companies House data and our own systems, we were able to locate social media profiles for one major shareholder. Despite these profiles being rather thin, they did provide a pointer to a new company and a family member who officially controlled this new business. Using the new family members social media profiles, we located a new Facebook account for our major shareholder, who recently left the UK in order to move to Eastern Europe - and one of the few friends he has listed is Mr. Domain.

For simplicity, we have missed out some of the steps taken (and the specifics of the crimes), but the above shows that one ‘third party’ person, who we called Mr. Domain, whose role involved digital tasks for a company involved in crime, can soon be linked back to other people and organisations that are potentially in the same line of crime, but at a higher level.

For this particular crime group, many are in prison, some are wanted by the police, and others have suddenly left the country. As for Mr. Domain, after a period of ill health, he is now unable to work.