U.S. Department
of Justice
Cyber & IP Europe
Background
The U.S. Transnational and High-Tech Crime Global Law Enforcement Network (GLEN) program is the result of a partnership between the U.S. Department of State Bureau of International Narcotics and Law Enforcement Affairs (DOS/INL) and the U.S. Department of Justice’s Computer Crime and Intellectual Property Section (DOJ/CCIPS) and Office of Overseas Prosecutorial Development, Assistance and Training (DOJ/OPDAT).
The GLEN is a worldwide law enforcement network of International Computer Hacking and Intellectual Property (ICHIP) attorney advisors, computer forensic analysts (Global Cyber Forensics Advisors or GCFAs), and federal law enforcement agents who deliver technical assistance to foreign partners to combat intellectual property and cybercrime activity, as well as to assist in the collection and use of electronic evidence to combat all types of crime, including transnational organized crime (TOC).
Currently, ICHIPs are posted to regional positions in Africa (Dar es Salaam, Tanzania and Addis Ababa, Ethiopia), Asia (Hong Kong S.A.R.; Kuala Lumpur, Malaysia; and IPR-focused part-time support from DOJ/OIA Attaché in Bangkok, Thailand), Europe (Bucharest, Romania; Zagreb, Croatia; and The Hague, Netherlands), and Western Hemisphere (São Paulo, Brazil and Panama City, Panama). Two subject-matter expert ICHIPs—the ICHIP for Global Internet Fraud and Public Health (IFPH) and the ICHIP for Global Dark Web and Cryptocurrency (DWC)—as well as DOJ computer forensic analysts and law enforcement officials with intellectual property and cybercrime expertise, also form part of the GLEN.
The objective of the GLEN is to protect Americans from criminal threats emanating from abroad by delivering targeted technical assistance to encourage both immediate improvements as well as long-term institutional change. This assistance includes workshops, legislative review, skills development, and promoting institutional reform such as the formation of specialized units to address these criminal threats.
Finally, the ICHIPs encourage countries to join the Council of Europe’s Convention against Cybercrime (Budapest Convention), as well as the G7 24-7 High Tech Crimes Digital Evidence Sharing Network (HTCN), an informal network that provides high-tech expert contacts to assist in preserving and sharing digital evidence.
IPR-Focused ICHIP
ICHIP Bucharest supports partner nations throughout Europe (Central and Eastern Europe and Central Asia) by assessing their ability to enforce IPR; designing and implementing technical assistance to enforce IPR; assisting in developing or strengthening institutions dedicated to IPR enforcement; monitoring regional trends in IPR protection; and furnishing expert assistance in support of U.S. intellectual property (IP) in the region. The ICHIP also assists foreign partners with IPR-related legislative drafting and preparing country submissions for the U.S. Trade Representative’s annual Special 301 Report. Finally, the ICHIP acts as a liaison between U.S. law enforcement partners in the region and rights-holders, whose support is critical for IPR investigations and prosecutions.
Cyber-Focused ICHIPs
ICHIP Hague and ICHIP Zagreb help foreign legal and law enforcement partners in Europe (Central and Eastern Europe and Central Asia) to combat transnational cybercrime and cyber-enabled crime by assessing their ability to detect, investigate, prosecute, and adjudicate cybercrime; providing technical assistance; assisting in developing or strengthening institutions dedicated to cybercrime enforcement; and monitoring regional cybercrime trends and providing expert assistance. They also review and comment on draft legislation that seeks to address cybercrime and related digital evidence issues. ICHIP Hague is also the Cybercrime Liaison Prosecutor at Eurojust, and in that capacity advances U.S. interests in multinational cybercrime investigations by leading coordination between U.S. DOJ prosecution teams and prosecution teams from other countries represented at Eurojust and Europol.
Cyber-Focused ICHIP Recent Activities
- On December 31, 2024, an EECWG member from North Macedonia reported a final conviction on the case for which ICHIP provided mentoring and the use of the Reactor license. This was a money laundering where the target was a money mule in connection with a crypto-investment scam. €80,000 was confiscated. This is believed to be the first successful money laundering conviction involving crypto assets in the country and credits the success largely to ICHIP’s mentoring.
- December 2024: In separate workshops in Kosovo and North Macedonia, ICHIPs Zagreb and The Hague provided technical assistance to prosecutors and law enforcement officers to advance investigations by supplementing more traditional investigative techniques and legal process with open-source intelligence and social media.
- December 2024: ICHIP Hague assisted a U.S. DOJ prosecution team investigating the LockBit ransomware criminal organization with coordination with prosecution teams from multiple other countries. The coordination has spanned multiple years and resulted in the disruption of the organization’s infrastructure and the arrest and conviction of multiple individuals involved in the operation of the LockBit organization.
- December 2024: ICHIPs The Hague and Zagreb welcomed prosecutors and law enforcement from around the world to The Hague for the first meeting of the Global Cybercrime Disruption Initiative (GCDI). The GCDI is an ICHIP initiative leveraging the ICHIP network’s global reach for proactive law enforcement actions to disrupt cybercrime networks. GCDI members from Croatia, Poland, Romania, Venezuela, Brazil, Costa Rica, Ghana, Nigeria, Kenya, Malaysia, Thailand, Singapore, and the Philippines discussed relevant cases and methods from recent years, as well as legal tools and frameworks.
- November 2024: ICHIP Zagreb and ICHIP DWC hosted the sixth in-person meeting of the U.S.-Eastern European Cryptocurrency Working Group (EECWG) in Opatija, Croatia, with participants from Bulgaria, Croatia, Czech Republic, Estonia, Latvia, Lithuania, North Macedonia, Poland, Romania, Serbia, and Slovakia. Instructors from the FBI, NCET, and Chainalysis provided technical assistance as to NFTs, bridges, decentralized exchanges, and international information-sharing in cryptocurrency investigations. Participants heard in-depth case studies on recent prosecutions of cryptocurrency fraud, including a successful Croatian investigation that benefited ICHIP assistance.
IPR-Focused ICHIP Recent Activities
- December 2024: In Kosovo, ICHIP Bucharest and HIS Special Agent Advisor co-hosted a workshop with the Department of Commerce Commercial Law Development Program (CLDP) on investigation and prosecution of intellectual property rights violations for 40 Albanian and Kosovar prosecutors, investigators, and customs officials. The workshop focused on investigative techniques, case studies, and working with rightsholders in both counterfeit goods and digital piracy cases. The program also encouraged cross-border collaboration between these two bordering countries in the Balkans.
- November 2024: In Krakow Poland, ICHIP Bucharest and Global ICHIP for Internet Fraud and Public Health (IFPH)—with support HSI and the National Cyber Forensic Training Alliance (NCFTA)—hosted a workshop on investigation and prosecution of digital piracy for 34 investigators and prosecutors from Bulgaria, Poland, Romania, and Ukraine. The program culminated in a full-day capture-the-flag exercise, where participants teamed up to apply their newly acquired investigative techniques in a simulated real-world setting.
- November 2024: In Romania, ICHIP Bucharest, the Romanian Chamber of Industrial Property Attorneys, and REACT Anti-Counterfeiting Network co-hosted a symposium on combatting counterfeit goods and implementation of Romania's IP Strategy for 75 Romanian police, prosecutors, judges, academics, private sector representatives, and IP attorneys. The program provided a forum to discuss increased collaboration on IP enforcement in Romania.