Criminal Organizations and Infrastructure that Enable Computer Crime and Intellectual Property Offenses

CHIP and non-CHIP AUSAs should continue their efforts to pursue large, complex, organized crime groups, including those operating in multiple countries. The disruption of criminal infrastructure that enables computer crime and intellectual property offenses can be particularly beneficial. These include:

illicit forums, websites, and platforms, including on the darknet, that are used by cybercriminals to communicate with one another, as well as to sell criminal goods and services;

hosting and other technology companies that deliberately offer online infrastructure (including Internet Protocol (IP) addresses, servers, virtual private networks, and domain names) to criminals in order to facilitate a variety of cybercrimes, such as by anonymizing the actors’ activities;

counter antivirus services (CAV) that allow “crypters” to test malicious files, URLs, IP addresses, and domains to ensure that they are not detected by antivirus solutions; and

mixing services and tumblers that let criminals hide illicit virtual currency transactions and launder criminal proceeds.

CHIP AUSAs should take steps to determine whether the computer crime and intellectual property offenses under investigation are being committed to fund or otherwise support terrorist activities or are being carried out by nation-state actors or their agents or proxies. For cases involving international terrorism or domestic terrorism, or affecting, involving, or relating to the national security, JM §§

9-2.136

,

9-2.137

,

9-90.010

, and

9-90.020

set forth notification, consultation, and approval requirements, including those at the opening and investigative stages, which may warrant additional prosecutorial resources (

e.g.,

the participation of an NSD National Security Cyber Section (NatSec Cyber) trial attorney or a district’s NSCS AUSA).

involving, or relating to the national security, JM §§

9-2.136

,

9-2.137

,

9-90.010

, and

9-90.020

set forth notification, consultation, and approval requirements, including those at the opening and investigative stages, which may warrant additional prosecutorial resources (

e.g.,

the participation of an NSD National Security Cyber Section (NatSec Cyber) trial attorney or a district’s NSCS AUSA).

CHIP AUSAs working on investigations that identify foreign targets or victims should, where appropriate and consistent with the requirements at

9-13.500

et. seq.

, utilize all available tools and law enforcement channels—including federal investigative agencies’ foreign legal attaches and attaches stationed in-country—to establish channels of communication with our foreign counterparts. Unlike formal methods of obtaining information, such as through Mutual Legal Assistance Treaties, informal evidence-sharing is often more efficient, and sometimes essential, in fast-breaking investigations. This approach has proved successful in obtaining greater cooperation and information sharing in recent international investigations. CCIPS, the Criminal Division’s Office of International Affairs (OIA), and the Money Laundering, Narcotics and Forfeiture Section (MNF) can be highly useful resources for CHIP prosecutors when pursuing international leads, seeking to recover forfeitable assets located abroad, and encouraging foreign enforcement of intellectual property and cybercrime laws. They have experience with such cases, and they have developed an extensive network of foreign law enforcement contacts by working international cases, providing foreign training and technical assistance, and leading such international initiatives as the G7 “24/7” Network, a collection of more than 90 countries committed to providing immediate assistance in cyber-related criminal investigations.

[updated January 2026]