Brian Levine

So what we started doing at that point was we had to use legal process.

We did hundreds or thousands of different legal process in this engagement, both domestically and abroad.

And so once we had a sense of who one of these actors was, we had more information that we could provide to Romania.

We did that through a mutual legal assistance treaty request, shortened as an MLAT.

And they started going up and doing whatever they did in Romania to try and get us helpful information pursuant to this legal process.

One thing we found was the existing process of MLATs back and forth was too slow for this case.

because the criminals kept changing their infrastructure.

So we had to work with our Office of International Affairs to create a faster process or an abbreviated version of the MLAT process.

What they were doing is actually moving locations, right?

They were moving.

Well, we didn't know what they were doing.

We just kept getting different IP addresses and different information.

So what we discovered through Romania's response to our MLAT request was

was that there were three people that were communicating with each other, one of which was the person that Ian had identified, with encrypted communications.

And we could not get through those encrypted communications, and Romania could not as well.

We could see that in their home,

on their non-criminal machines where they weren't encrypting all their traffic.

They were going to cryptocurrency websites and specific ones that we knew this group was focused on.

But that wasn't really strong evidence.

It wasn't enough to indict them or extradite them or anything else.