Norwegian chieftain Ingólfr Arnarson was the first person to permanently settle in Iceland in 874 A.D. In the centuries since, the island country’s population has expanded, but compared to other countries in Europe, only modestly. There are about 364,000 people living in Iceland today, and most reside in or near the capital city of Reykjavík, in the southwest region of the country.

Iceland has a low level of general crime and a very low level of violent crime.[1] Research from the U.S. Department of State’s Overseas Security Advisory Council (OSAC) attributes Iceland’s low crime rate to several factors, including the population’s high level of trust in law enforcement and a well-trained, highly educated police force.[2] The Icelandic Police, or Lögreglan — “the Law Order” — also has a small population in terms of personnel: only 700 officers serve in nine districts across the country.

Eiríkur Ásgeirsson, Detective inspector, Suðurnes Police, Iceland
Eiríkur Ásgeirsson, Detective Inspector, Suðurnes Police, Iceland

Iceland may not see a lot of crime, generally, but the officers of the Lögreglan are often called to investigate serious and complex criminal activities, from cybercrimes to money laundering. Iceland’s geographic location makes it “a targeted source and transit country for crime groups smuggling illicit merchandise into or from European markets and Scandinavia,” says INTERPOL.[3] And Detective Inspector Eiríkur Guðni Ásgeirsson, who works in the Serious Crimes Unit for the Suðurnes Police Department, knows Iceland’s attraction for criminals all too well.

“One of our department’s responsibilities is securing Reykjavík Airport, the main entry point into Iceland,” says Detective Inspector Ásgeirsson, who is a 20-year veteran of the Lögreglan. “We see everything from human trafficking cases to drug import cases to falsified passports. So, there’s a lot of casework — and a lot of devices — for our team to handle.”

Gathering More Evidence in the Field — and Solving Cases Faster

The devices Detective Inspector Ásgeirsson refers to are mobile phones and other small data storage devices like thumb drives and memory cards. “In almost every case that we investigate, there are mobile phones to examine,” he explains. “People take videos, and they exchange messages. We also need to check the locations of victims and suspects to see if everything matches.”

For that work, Detective Inspector Ásgeirsson and 11 other detectives in his department use Cellebrite’s Digital Intelligence Platform to access and collect key digital evidence from these mobile devices and the Cloud. They also tap Cellebrite’s Advanced Services (CAS) when they need case assistance, advanced accessing and data collection services, and other technical assistance.

“Every case has some type of digital evidence, and the sooner we get our hands on that evidence, the better. Only a few years ago, no one thought about using mobile phones or data from phone companies when working on a case. Today, it’s standard procedure.”

“The forensics department in Reykjavík is drowning in cases, so they cannot do analysis, like database collection, for other departments,” says Detective Inspector Ásgeirsson. “It’s a lot easier for us to do the analysis ourselves. So, we purchased Cellebrite’s UFED Touch2 platform in 2017.”

He says that Cellebrite’s platform, along with the Cellebrite Physical Analyzer, allows his team to gather more evidence, provide digital intelligence reports to investigators, and help solve cases faster. The forensic team in Reykjavík uses Cellebrite’s DI solutions, too, which is how Detective Inspector Ásgeirsson and his department learned about the technology.

Forensic imaging work related to device inspection is Detective Inspector Ásgeirsson’s area of expertise. “In larger, more complicated cases, I also handle the device examination,” he says. “And when we need to get data from phone companies for a case, that work usually lands on my desk, as well.”

One thing Detective Inspector Ásgeirsson and his colleagues in the Suðurnes Police Department were not expecting to see land on their desks, however, was an investigation into what would later be deemed “the biggest burglary in the history of Iceland.”[4] A small group of enterprising criminals banded together to steal hundreds of computers used for mining the cryptocurrency Bitcoin. After breaking into several cryptocurrency data centers in Iceland over a two-month period, the thieves had stolen more than $2 million worth of technology equipment — from motherboards to power accessories.[5]

“Most of the break-ins were in our local area,” says Detective Inspector Ásgeirsson. “That’s why our department took over the investigation.”

Lax Security at Cryptocurrency Data Centers Made Thieves’ Work Easy

Iceland’s status as the world’s leader in digital currency mining may be surprising to many people. But this ancient, Nordic island country has several attributes ideal for supporting this unusual 21st-century industry: a low crime rate, plenty of cheap warehouse space, an abundance of inexpensive geothermal energy, and a polar climate.

The latter two factors are especially important, because the computers used for mining must be both powered and kept cool 24/7/365. Also, Iceland — which was hit hard by the 2008 global financial crisis — fully embraced the opportunity to be a home for major cryptocurrency mining operations, which first began setting up shop in the country in 2014.

To make money from cryptocurrency mining — and much virtual money can be made, even though Bitcoin’s price has been dropping significantly in recent months[6] — miners need a lot of computers that can work super-fast. And Sindri Thor Stefansson, an Icelandic man who already had a criminal record and some jail time to his name, figured that stealing the devices was the most efficient way to get his own mining operation started. So, Stefansson, with help from four other associates, hatched and executed a plan to break into cryptocurrency data centers and take what they could.

Burgled building in Borganes
In Borgarnes: This building was burgled during the night – the thieves wanted to steal computers from a data center. Source: FRÉTTABLAÐIÐ/ERNIR

“Cellebrite’s Advanced Services team was able to collect every type of digital evidence imaginable from the suspect’s iPhones — locations, images, Telegram messages — basically, everything we needed to prove the case and secure the convictions.”

It proved to be easy work, as security at these facilities was lax — and for their very last hit, the thieves were even helped by a security guard. Also, the owners of the data centers weren’t keen to advertise the break-ins, as they didn’t want to upset their foreign investors.[7] But one owner, whose data center in the town of Borgarnes was cleaned out, did call the police, and that set in motion an investigation that would eventually lead to the prosecution of Stefansson and his cohorts.

More Digital Evidence Than Investigators Had Hoped For

“The main part of the investigation, at first, was trying to find suspects,” says Detective Inspector Ásgeirsson, who worked with eight other investigators on the case. “We didn’t have any leads. So, we looked at footage from surveillance cameras and found rental cars that were used in the crimes. We tracked down the individuals who rented the cars, and then started our surveillance of those individuals, using trackers, wiretaps, and so on.”

Sindri and two of his friends posted on social media after they met in Amsterdam after he escaped (all got sentences in the case).
Hafþór Logi (left) with Sindri Þór Stefánsson (right) and Viktor Ingi Sigurðsson in Amsterdam. Hafþór posted this picture on social media while the police searched for Sindri who had escaped from the prison in Sogn. Hafþór Logi is one of the accused in the Bitcoin case. Source: https://www.visir.is/

These traditional investigation tactics were highly effective. Within about a week or so of setting up surveillance, the Lögreglan rounded up several suspects, including Stefansson. But then, the investigators hit a wall. “The suspects were very uncooperative — they were not admitting anything,” says Detective Inspector Ásgeirsson. “And they would not grant us access to their phones or provide their PINs.”

The investigators were eager to gather any digital intelligence from the suspects’ devices that would lead to convictions. But they were especially interested in examining the data on Stefansson’s two Apple iPhones, as they believed he was the one who had planned the operation.  “We had to get a court order to examine the devices,” says Detective Inspector Ásgeirsson. “And the rest is history, as they say.”

The investigators had already learned, by gathering data from phone companies, that the suspects had used many phones and phone numbers throughout their operation. “They also used online messaging apps like Telegram to create almost secure lines of communication,” says Detective Inspector Ásgeirsson. “The complexity of this investigation was overwhelming.”

Once they obtained the court order, the investigators used Cellebrite’s UFED Touch2 to access data from the devices of Stefansson’s associates and then applied the Cellebrite Physical Analyzer to examine the digital evidence. However, because the thieves had gone to such lengths to conceal their digital activity, the examination did not yield enough evidence to guarantee a conviction.

Advania data center - where the largest theft took place.
Iceland’s cold temperatures and ample warehouse space are prime locations for cryptocurrency mines where cool temperatures are needed to keep massive computer networks functioning. Advania data center (above) is where the largest databank theft took place. Source: https://www.mbl.is/

Detective Inspector Ásgeirsson and his colleagues remained hopeful that the data on Stefansson’s iPhones would help to fill in the story. They needed to send those devices to Cellebrite’s CAS team in Munich, Germany, for advanced device access and data collection. The result: They uncovered a trove of data relevant to the Bitcoin heist.

“The CAS team was able to collect every type of digital evidence imaginable from the suspect’s iPhones — locations, images, Telegram messages — basically, everything we needed to prove the case and secure the convictions,” says Detective Inspector Ásgeirsson. He adds that the Telegram messages Stefansson had saved on his phone also helped lead investigators to another suspect in Spain.

“Without the evidence from those devices, I’m not sure we would’ve gotten the convictions,” he says. “And I know we only managed to get a conviction of the suspect we located in Spain because of the Telegram messages on Stefansson’s phones.”

Plenty of Convictions — But No Sign of the Stolen Computers

Stefansson was sentenced to 4.5 years in prison for the Bitcoin heist. Five other individuals prosecuted — including the data center security guard — received sentences ranging from six months to 4.5 years.

Court picture
Data collected from suspect’s phones by Cellebrite Advanced Services led to the conviction of Sindri Þór Stefánsson (the man in the middle with the blue jacket), who spearheaded the thefts, and his accomplices. Source: https://www.visir.is/

As for the computers that Stefansson and his associates stole, they have not yet been found. “We even checked the electrical usage in some remote areas that have big storage facilities where the machines might be put to use. But it was no help, we didn’t find anything,” says Detective Inspector Ásgeirsson. “Maybe the computers are in another country now? We have no idea.”

The Bitcoin heist in Iceland proves that major crimes can happen anywhere. And, while traditional policework remains effective for tracking down suspects, digital intelligence collected from mobile devices is what allows investigators to build strong, evidence-backed cases that can lead to convictions.

Detective Inspector Ásgeirsson says he was a firm believer in using digital forensics and related tools for investigations prior to the Bitcoin case — his team’s proactive investment in Cellebrite’s technology is a proof point. He says he would like to see more law enforcement agencies in Iceland, and elsewhere, adopt formal digital intelligence strategies and invest more in digital forensics training for officers.

“Technology doesn’t help to ease our workload, but it helps us get the evidence we need. And having a specialized investigator — someone like myself — to handle data collection and find digital intelligence allows the other detectives to focus on interviews and other evidence.”

He adds, “Every case has some type of digital evidence, and the sooner we get our hands on that evidence, the better. Only a few years ago, no one thought about using mobile phones or data from phone companies when working on a case. Today, it’s standard procedure.”

Sources:
[1] Iceland 2019 Crime & Safety Report, OSAC, March 8, 2019: https://www.osac.gov/Country/Iceland/Content/Detail/Report/2d8cdd85-eb54-4ec7-828a-15f4aeb18469
[2] Ibid. 
[3] “How INTERPOL supports Iceland to tackle international crime,” INTERPOL website, accessed July 2020: https://www.interpol.int/en/Who-we-are/Member-countries/Europe/ICELAND
[4] “The Big Bitcoin Heist,” by Mark Seal, Vanity Fair, December 2019: https://www.vanityfair.com/news/2019/11/the-big-bitcoin-heist
[5] Ibid. 
[6] “Traders Brace for Big Drop as Bitcoin Dips Below $9K for Seventh Time,” by Joseph Young, Cointelegraph.com, July 2, 2020: https://cointelegraph.com/news/traders-brace-for-big-drop-as-bitcoin-dips-below-9k-for-seventh-time.
[7] “The Big Bitcoin Heist,” by Mark Seal, Vanity Fair, December 2019: https://www.vanityfair.com/news/2019/11/the-big-bitcoin-heist.