Gone for Good? International Operation to Dismantle Gensis Market Demonstrates How Success in Policing Transnational Cybercrime is Limited by Jurisdiction

           The Justice Department recently announced an international coordinated operation to dismantle Genesis Market, “a criminal online marketplace that advertised and sold packages of account access credentials–like usernames and passwords for email, bank accounts, and social media–that had been stolen from malware infected computers around the world.”[1] This concerted international effort to take down the Genesis infrastructure shows the power of a large international partnership in policing transnational cybercrime. However, the inability of such a large international partnership to arrest or even locate the operators of the Genesis Market demonstrates the limits to policing transnational cybercrime because of a lack of jurisdiction.

            Genesis Market is known as an initial access broker, where criminals wanting to easily infiltrate a victim’s computer can buy packages of already stolen credentials and use it to access a victim’s sensitive data.[2] Included for sale on the Genesis Market were access credentials associated with the White House, Justice Department, Department of State, Department of Defense, USPS, NASA, and the IRS.[3] Genesis was seized in Operation Cookie Monster, an effort that involved 17 countries and was led by the U.S. Federal Bureau of Investigation and the Dutch National Police.[4] The operation entailed the seizure of Genesis Market’s domains and simultaneous actions against its users across the globe that resulted in over 200 property searches and 119 arrests.[5] U.S. Attorney General Merrick Garland stated, “Our seizure of Genesis Market should serve as a warning to cybercriminals who operate or use these criminal marketplaces: the Justice Department and our international partners will shut down your illegal activities, find you, and bring you to justice.”[6] While Attorney General Garland’s statement may be true for some of those who used those criminal markets, it seems to be more of a hollow threat when applied to the market’s operators.

            The international partnership did not claim to have arrested any operators and only stated it is believed that the Genisis Market is operated out of Russia.[7] Likewise, the announcements from Europol and the other international partners include a request for anyone with information on the administrators of Genesis Market to contact the FBI.[8] The international partnerships inability to arrest or even definitively locate the market’s administrators highlights an important reality: as long as countries like Russia continue to harbor cybercriminals, jurisdiction will continue to be a serious obstacle in the effort to police transnational cybercrime.

            The distributed nature of computer networks allows cybercriminals to anonymously target people regardless of jurisdiction.[9] Nations have enacted legislation permitting the exercise of extra-territorial jurisdiction over cybercrime offenders, but exercising such jurisdiction has been more challenging in practice than in theory.[10] Some have suggested that the use of an international treaty, similar to previous international treaties created to address other transnational crimes like piracy, is necessary for policing cybercrime.[11] An international treaty, however, would not solve the unique complexities in policing cybercrime, like how an individual can hide their identity and location while committing cybercrime.[12] Moreover, an international treaty would require that nations agree to turnover cybercriminals, which the nations harboring cybercriminals have been unwilling to do thus far.[13]

            The dismantling of Genesis Market’s infrastructure will undoubtedly hinder the ability to facilitate transnational cybercrime.[14] That said, with the operators still out there, it is likely the Genesis Market will effectively re-emerge and continue operations on the internet.[15] Indeed, the Genesis Market can still be accessed on the dark web, and the site’s administrators have already announced they plan on setting up new domains.[16]

            Europol, the U.S., and the other international partners joined together in the fight against cybercrime may have the power to dismantle these new domains that emerge, too. Nevertheless, they will always be limited in success by their lack of jurisdiction over the individuals operating these illicit markets. Without the ability to prosecute the individuals responsible and stop them from operating, the members of the international partnership are effectively stuck in a game of virtual whack-a-mole: frantically smacking down each new market that emerges while being unable to stop new ones from emerging.