On March 10th 2022, the ACAMS Carolinas Chapter hosted a virtual event to discuss ways to combat human trafficking which continues to occur across the Carolinas, the United States, and throughout the world and is estimated to be a $150 billion global industry. The event was moderated by Board member Nicolas Khouri who is also the Deputy BSA Officer at Ally Bank. The speakers included:
· Larry Cameron, Chief Information Security, Anti-Human Trafficking Intelligence Initiative (ATII)
· Sara Crowe, Strategic Initiatives Director, Financial Systems, Polaris
· Brian Filbert, Senior Compliance Director, Ally Bank
Sara kicked off the call by defining Human Trafficking as a form of modern-day slavery in which traffickers use force, fraud, or coercion to control victims for the purpose of engaging in commercial sex acts (prostitution) or labor services against their will and noted individuals under the age of 18 are considered too young to consent to this type of work and therefore do not have to meet the requirement of force, fraud or coercion.
Sara indicated the best available trafficking estimates come from the International Labor Organization’s Global Modern Slavery Index which, utilizing the U.S. federal trafficking definition, suggests there are nearly 25 million worldwide victims with approximately 16 million tied to forced labor compared to an estimated 40 million using the international trafficking definition. Since human trafficking is considered a “hidden crime”, these estimates are believed to only represent a small fraction of the actual victims.
Sara’s organization, Polaris, maintains the National Human Trafficking Hotline that connects victims and survivors of trafficking with services and support. Since the inception of the hotline in 2007, Polaris has logged over 80,000 domestic trafficking situations and collected statistics tied to these calls. Human trafficking is considered an incredibly diverse crime because it entails non-consensual participation in any economic activity. This means it can span any industry, type of labor, work, or service. Many times trafficking situations are un-networked and smaller in scale than what is depicted in popular films like 2008’s Taken. Often times, victims of sex trafficking are recruited by a family member or romantic partner while victims of labor trafficking are recruited by companies that appear to be hiring legitimately.
Sara noted Polaris has documented 25 different types of trafficking, which is not exhaustive, that are commonly seen across the United States. The panel acknowledged it is very hard for financial institutions to keep up with all of the various trafficking typologies given the diversity of the crime.
Sara discussed several 2020 national statistics and indicated case volume generally reflects population which is why California has the most reported cases. In 2020, North Carolina was ranked number nine (9) and South Carolina was number twenty-two (22) nationally. Specific North and South Carolina statistics are noted below:
Sara also discussed several high risk labor trafficking industries and labor trafficking considerations that financial institutions should contemplate when opening and reviewing client accounts. Given the preponderance of labor trafficking, Sara discussed a 2021 southeast United States agricultural case known as Operation Blooming Onion which is estimated, since 2017, to represent 70,000+ victims, $200 million in revenue and 24 defendants charged with 54 counts of criminal activity.
The panel shifted the conversation to discuss coordination between non-profit organizations, like ATII and Polaris, and financial institutions. Larry noted that in 2020, there were only 15,814 SARs filed using the Human Trafficking checkbox. This equates to less than one SAR filing per day, per state over the period of a year which reinforces the need to train staff and provide resources like red flag typologies in order to properly identify this activity. Brian agreed that the number of SAR filings is low and that banks have to be very proactive in order to identify trafficking risk because it doesn’t fit well with transaction monitoring and requires good intelligence, a high level of data analytics, and significant, ongoing refinement. Larry explained how ATII partners with financial institutions by providing curated data sets tied to sexual services collected from the Dark web. Data sets may include names, email addresses, phone numbers, postal addresses and domain names. Supported financial institutions take this data and scrub it against their client base where potential matches typically trigger enhanced due diligence. Larry also demonstrated ATII’s ability to create cluster mapping and data modeling, using business data sets in combination with watch lists and other records from industry leaders like Dow Jones, Dun and Bradstreet, Open Corporates, etc., to identify the underlying registration information behind the businesses selling this type of service in order to identify businesses, including those that are unregistered, that may be involved in trafficking.
Sara explained how Polaris, through its collection of survivor-centered research, National Human Trafficking Hotline insights, and open source intelligence, partners with financial institutions and law enforcement via direct consultation and bi-monthly discussions to provide tips and insights to help identify this activity. Sara described how Polaris formally shares sensitive, but unclassified information, along with confidential open source intelligence, such as online billing descriptors, to help financial institutions zero in on higher risk accounts that are engaging with these sites. Sara noted that sex traffickers have diversified their business models since the beginning of the pandemic. It is not uncommon for in-person prostitution networks to also operate online accounts through OnlyFans and other service providers. Sara reminded the audience that commercial sex transactions with escort sites include people engaging in prostitution, or commercial sex, and may not represent a connection to sex trafficking. Sara suggests banks be on the look-out for indicators a minor may be involved (automatic sex trafficking) or indicators of a third party facilitator including:
· Businesses owned or managed by multiple people,
· Cash deposits made by multiple people or at distant locations in the same day,
· Frequent travel related expenditures (hotels, gas, fast food),
· An unusual number of unrelated individuals tied to a single account, or
· Common secondary account holders across multiple unrelated accounts.
Brian noted that banks also have an opportunity to identify potential trafficking activity with minors based on the type of products the financial institution offers, such as high school checking accounts, and reviewing those transactions for billing descriptors from companies such as OnlyFans or for the activity noted above. If these transactions are observed, Brian suggested banks apply traditional trafficking red flag indicators as part of a deeper transactional review.
Brian described an intelligence cycle that banks can utilize if they obtain data sets similar to what is provided by NGOs like Polaris or ATII. In order to use the data effectively, banks need to ensure their data analysts have the right tools and access to the right data to begin producing productive results. Once this is established, the bank should run the trafficking indicators against the client base to determine which clients require additional due diligence. If investigators notice that the initial data runs produce a large number of alerts, or alerts that don’t make sense, then the data analysts should make adjustments to the thresholds (dollar amounts, number of transactions, geography, etc.) and run the indicators again. This step is repeated until the indicators produce valid results. Once the indicators are confirmed, a bank should develop a cadence for how often the searches will be re-run e.g. monthly, quarterly, or semi-annually, etc. and begin working with transaction monitoring to see if scenarios can be built to identify human trafficking. Brian encouraged banks, through an investigative example, to be on the lookout for emerging trends or indicators. In the example, Brian noted that the investigators, as they worked trafficking alerts, determined that a large portion of the client population was making repeat payments to a technology company. While the reason for the payments remained unknown, the investigators included the additional information in the SAR filings for law enforcement to investigate and added the technology company to its list of trafficking indicators.
Larry wrapped up the call by discussing ATII’s Darkweb intelligence platform known as Project Hades. Larry explained how Project Hades scrapes websites on the Darkweb (sites hosted on restricted networks) for evidence of trafficking and Child Sexual Abuse Material (CSAM) through various data points including email, IP and Bitcoin addresses, SSH keys, or images. Project Hades takes the collected evidence and utilizes Blockchain forensics, network graphs, and clustering analytics to connect the dots between these various data points in order to investigate, categorize, identify, and ultimately report the network of sellers, buyers and administrators of the websites to law enforcement.
For additional information regarding Polaris analysis and research, email si-financial@polarisproject.org.
For additional information regarding ATII and Project Hades, email: larry@followmoneyfightslavery.org
Follow-us on LinkedIn and join the ACAMS Carolinas Chapter so you don’t miss out on these conversations and future events!
Blog Written by: Board Member, Sean Marsden, CRC, CAMS