Credit Management January February 2022

CYBER FRAUD
AUTHOR – Adam Bernstein
on, and the recovery of assets from, unidentified
defendants – persons unknown.”
And of the more recent case of Fetch.ai v
Persons Unknown, says Louise, develops the
law even further: “It demonstrates the UK
courts’ willingness to overcome potential legal,
technical, and procedural hurdles wherever
possible, to ensure that justice can be served for
victims of this largely faceless fraud.”
In delving into the first case, AA v Persons
Unknown, Louise says that the victim
company had received a ransom demand from
unidentified defendants who had hacked and
encrypted the business’ computer system. The
company’s insurer paid the Bitcoin equivalent of
$950,000 so that the system could be decrypted,
and trading could continue. The insurer then
sought to recover the defrauded assets via claims
against persons unknown – the hackers and
unidentified persons controlling the accounts
into which the ransom was paid – and against the
Bitcoin exchange itself.
She says that the court made orders – more on
this below – to enable the claimant insurance
company to discover the identity of the
defendants and to facilitate the preservation,
tracing and potentially, ultimately, the recovery
of the lost cryptocurrency.
Louise says that several legal and practical
points arose from the case: “Firstly, publicity
could have tipped off the unknown defendants
enabling them to dissipate the Bitcoin. It could
also have triggered further attacks, including
revenge or copycat attacks.” She adds that “the
court had been provided with confidential
information to determine the issues. It was
possible that the Bitcoin exchange defendant had
been mixed up unknowingly in the wrongdoing
of the as-yet unidentified defendants.”
It was for these reasons that she says it was
appropriate for this hearing to be held without
notice and in private.
But by the very nature of the crime, it was not
known where the unidentified defendants were
based. The Bitcoin exchange defendant was
based outside of England and Wales and appeared
to have addresses in China and the British Virgin
Islands. However, as Louise explains, “the claims
fell under certain permitted jurisdictional
gateways; and the Bitcoin could have been
dissipated at any moment.” As a result, it made
sense for the court “to make orders for service
out of the jurisdiction and for service by e-mail
at any address relating to the Bitcoin account, by
delivery to any physical address relating to the
account and by filing the claim at court.”
The claimant insurer sought a proprietary
injunction with regard to the Bitcoin. “The court,”
Louise says, “confirmed that crypto assets such
as Bitcoin are property and can be the subject of
proprietary relief. A proprietary injunction was
therefore granted, along with ancillary orders
requiring all respondents to provide information
as to the identity of persons unknown.”
In overview, a proprietary injunction prevents
a person from dealing with assets in which a
claimant has a proprietary interest. Proprietary
injunctions attach to the assets in question,
unlike freezing injunctions which attach to
defendants and respondents personally, and so
give greater security to a claimant. Proprietary
injunctions are also less intrusive against
defendants compared to ‘freezers’ which means
that they may be more readily granted.
“It demonstrates the UK courts’ willingness
to overcome potential legal, technical, and
procedural hurdles wherever possible, to
ensure that justice can be served for victims
of this largely faceless fraud.”
But where a claimant does not have a
proprietary claim, Louise says that they
can pursue a freezing injunction even in
circumstances where the identity of the wrongdoers
is unknown. She adds that “a flurry of
recent case law in this area demonstrates that UK
courts are generally willing to take a sensible and
pragmatic approach to awarding an injunction to
assist a victim of fraud or other harm/tort caused
by persons unknown.”
Louise points out that applications for
injunctions often need to be supported by
specific additional tactical orders, “perhaps
requiring third parties to disclose information,
documents or even identities that would
otherwise be subject to duties of confidentiality.”
As she has seen, these orders can require
institutions – such as banks or other businesses
based outside the jurisdiction – to provide
information in line with an order of the English
court. But as Louise highlights, “jurisdiction for
the English court to make such orders has to be
established on a case-by-case basis. It was one
of the key issues addressed in Fetch.ai v Persons
Unknown, the second case.”
In this instance, she explains that hackers
(the persons unknown, the first defendants
and respondents) gained access to private keys
associated with cryptocurrency accounts held by
the claimant at the Binance currency exchange
(the second and third respondents). “The
hackers,” she says, “removed cryptocurrency
from the accounts and sold it on at a massive
undervalue, apparently to co-conspirators,
causing loss of some $2.6 million to the claimant.
The claimant therefore applied for, and was
granted, a proprietary injunction, a worldwide
freezing order and disclosure orders requiring
third parties to provide information to assist in
tracing the assets.”
In this case, the court confirmed again that
cryptocurrency is recognised as property under
English law. Here Louise comments that “the
judge also decided that the claimant's private
Brave | Curious | Resilient / www.cicm.com / January & February 2022 / PAGE 17 continues on page 18 >