DAPPCON 2024: A Conspiracy To Protect Your Rights - Peter Van Valkenburgh

Transcript

this talk is about the implications of the tornado cash um prosecutions that we're seeing in the Netherlands and in uh the southern district of New York and the United States um I want to start with my background and a disclaimer uh I am an attorney at coin Center coin Center is not a law firm it's a civil liberties advocacy organization we're based in Washington DC and we have been operating since 2014 to try and educate people in government especially the US government about these Technologies so that they can make good policies out of a position of knowledge rather than bad choices out of a position of ignorance and ultimately to defend people's digital civil liberties I am a lawyer but I'm not your lawyer so

if you're um watching this talk and you think you're taking some you know useful legal advice from me you're not if you're building in this space as you'll see in this talk you are potentially facing very real risks and very specific risks based on what you are actually doing the specifics of what you're doing and so whether you like it or not it's wise to actually talk with a lawyer who you hire who represents your interests and you can figure out your own risk appetite coin Center is here to Advocate especially in the legislature and in the courts to the extent we do bring lawsuits for broad crypto-friendly interpretations of underlying constitutional law so a broad

interpretation of the first amendment that would protect more activities Under The Heading of free speech expressive activities though those interpretations may not always win in court we're also here to advocate for reasonable and narrow interpretations of criminal laws of regulatory policies things like what we will discuss with respect to liability for money laundering or liability for unlicensed money Transmission in this talk we make the strongest case for these interpretations in order to move the Overton window to get good policy that protects innovators and to make sure that people who are just trying to build important tools for human flourishing don't end up on the wrong side of a prosecution and

certainly don't end up in jail if they do get prosecuted but you should not rely on these interpretations you should talk to a lawyer and if after talking to a lawyer or maybe even just after listening to the this talk you were building privacy tools and you think I don't know if I want to build privacy tools anymore because of the legal risks I totally get you the space has gotten a lot more frightening just over the last two years and the risks are very real and that unfortunately is exactly why this fight right now is very important because people are no longer some people are for very reasonable um justifications not building these tools or not publicly building these tools because they're afraid of prosecution and if there's anything that the

American First Amendment is intended to protect it's the marketplace for ideas and these overzealous prosecutions I would argue are effectively chilling this market for ideas saying you know what maybe we don't need more ideas and Innovations about personal financial privacy just don't come up with those ideas and if you do come up with those ideas maybe you'll go to jail that's not an open Society that's not a liberal democracy that's a form of totalitarianism so with that table setting this is one of two talks I'm giving on this visit to Berlin um both talks deal with the implications of the recent tornado cash

prosecution this one's focused on the money laundering charges and the unlicensed money transmission charges and the nature of conspiracy criminal conspiracy charges generally uh and I'm also going to cover the samurai indictment a little bit the other talk will focus on us sanctions laws um um which in some ways triggered this whole situation when ofac sanctioned the tornado cach tool in August of 20122 that sanctions law talk will be at Earth Berlin eth Berlin tomorrow um at 17:30 so I just want to throw the timeline up here so that for people who are just looking for basic you know news about the where we are in these

prosecutions um it all started in August 2022 with the sanction being announced and Alexi being arrested in the Netherlands some months later Alexi was charged after being held without charges in jail and no bail he was charged with money laundry uh in August of 2023 Roman storm was arrested and storm and seov um other co-developers of the tach protocol were indicted in the southern district of New York and they were charged with conspiracy to launder money to do unlicensed money transmission and to at sanctions in March of 2024 Roman storm uh filed a motion to dismiss the charges

against him arguing that the doj had insufficiently pleaded any criminal Behavior Uh that for which he could be held culpable uh and the uh government filed a reply brief this past April arguing that they do think they sufficiently alleged money laundry uh unlicensed money transmission and uh violations of sanctions I bring this up because this is the most recent big comprehensive statement of how the government sees the laws applying in this space in the US and it is extremely broad now a prosecutor has to make the strongest arguments they can legally in

the hopes of winning a case that's their job but I would say a prosecutor should not be making arguments that clearly go against or contradict existing law and precedent and this brief comes really close quite frankly and so if you want to see the absolute broadest interpretation of where you could be liable for developing privacy tools this is a good place to start looking it's the broadest theory of unlicensed money transmission and money laundering culpability that you'll find at least in the US um in the US system in April developers of the Samurai wallet which was a Bitcoin wallet that did confidential trans actions as a way to improve privacy uh

the developers were indicted in the southern district of New York as well uh they were charged with conspiracy to law under money and unlicensed money transmission two of the same charges as in the tornado cash case and in May of 2024 a verdict was announced in the Dutch case uh for Alexi and he was sentenced to 64 months of jail these three things are what the remainder of this Talk's going to focus on uh CU I think there's a lot to be gleaned from from what's happened most recently in these three indictments and the verdict so I want to start with some key background Concepts and distinctions that people in the space who are building privacy tools should be aware

of I think if you're not a lawyer and you just read the news it just looks like prosecution prosecution and you you may not be you know aware of the important distinctions in the way these prosecutions are being pursued sued both in the sdny and in the Netherlands so the first thing to look at is what exactly is being charged because the prosecution has to prove a different set of facts to prove a different crime so money laundering unlicensed money transmission and sanctions evasion are the three things that are in stake at stake in the sdny and in the sdn it's conspiracy to do these things and this is important to

note because this changes again the facts of the government has to present if you actually launder money for someone they have to prove your intent that you uh knew that you were concealing the proceeds of some specific crime and actually did conceal them if you want to prove conspiracy you merely have to prove if you're the government that somebody agreed with a bunch of other people to knowingly conceal the proceeds of crime and the question of when you see agreement and how broad can the conspiracy be is highly relevant in this space I think for obvious reasons because a lot of these tools are either genuinely or sometimes in genuinely but

quite often genuinely decentralized and if you can make an argument that the conspiracy is everyone on the ethereum blockchain that's mining writing software validating transactions Etc then maybe it's going to be easier for the government to prove culpability for the development of a privacy tool but at some point this becomes absurd because are we really all in agreement on the ethereum blockchain that it should be used for ilicit purposes are we all working together to help North Korea that's ridiculous um what is the background law is another thing to keep in mind so I'll go into it a little bit but the Netherlands for example has a different

standard of Criminal Intent for money laundering than the US it has a very broad standard which could catch a lot of people as culpable effectively if it's interpreted the way it has been in the perv verdict it's basically a negligence standard there's also other relevant law there's underlying regulatory definitions in law for example if you're being charged with unlicensed money Transmission in the US the government is saying you were doing money transmission and we have laws on the books that say that those who are doing money transmission need to register with a particular regulator in the case of money transmission finsen which is a division of Treasury finsen has through guidance and rulemakings further

clarified and defined what money transmission is and we'll get into that a little bit the problem is that doj doesn't necessarily need to give finson guidance weight and can say well even though you read the guidances saying you weren't doing money transmission we interpret the underlying Authority in the statute as you doing money transmission for which you didn't have a license even though the the person you were supposed to get a license from said you didn't need a license finally there's constitutional law defenses That Vary based on jurisdiction so in the United States we have a fairly rich and robust tradition of protecting expressive conduct as speech which means the government has to meet a very high burden of proof to justify regulations or criminal

enforcements that chill or otherwise ban uh or limit speech activities and so this could be a defense to overzealous prosecution in the United States in the European tradition there is less robust reasoning about what is speech and where the limits of the criminal law lie with regard to speech and finally there are distinctions to be drawn about what facts are alleged in any particular circumstance if we're talking about just being liable for publishing and distributing privacy tool software that's one thing what about other things what about maintaining a website that has a front end what about broadcasting

transaction messages sign transaction messages even if you have no control over the underlying funds what about the use of relays within a scheme uh like in tornado cache what about mining validating running coordination servers in the case of confidential transactions and the samurai wallet indictment and do you take fees these all can potentially influence How likely it is that your activities will be either protected by the First Amendment or unprotected How likely you will fit the factual patterns required to prove things like money laundry I'm not going to go through this slide you can take a picture of it this is a rough breakdown of some of the distinctions so for example Alexi is

being charged in the Netherlands for money laundry Roman uh the two Romans are being charged in the United States for all three of those offenses Alexi is facing uh moneya laundering charges where the government only has to prove a Dutch intent standard which is basically a negligent standard in the US the standard of intent whether you knowingly and if you will willfully were uh facilitating money laundry which is in many ways a stricter standard though could be flexible even in this case so with the remainder of my time I want to get into some more specific areas and zoom in because there's a lot here so as I said the unlicensed money transmitting charges are particularly worrying because the doj appears to be

taking uh this theory of what is money transmission for which you needed a license and building it out of whole cloth and ignoring the established guidance from the relevant licensing regulator registering regulator finsen for the last 10 years uh for longer than 10 years actually so this quote here from the motion um in response to Roman's motion to dismiss from the doj says section 1960 this is the unlicensed money transmission Statute in the United States so this is how you criminalize unlicensed money transmission section 1960 does not require the business to have control of the funds they argue that the definition is broader than the

actual definition in the bank secrecy act which is the regulatory statute and far broader than the narrow guidance that's been offered by fin sen to date as to who is doing money transmission and needs to regulate or needs to to be to register with the regulator this is the 2013 administrative ruling from finsen where they clearly say that the production and distribution of software is not in itself money transmission even if the purpose of that software is to facilitate transactions in Virtual currency below it is the finsen 2019 guidance where they said quite clearly that in the context of multisig wallet as an example even partial control over

the user funds is insufficient to classify the wallet developer as money transmitters because quote the person participating in the transaction to provide additional validation at the request of the owner the user of the wallet and the owner of the funds in the wallet does not have total independent control over the value so obviously you can see a very big discrepancy between what the regulator has been saying is conduct that requires a license and what doj is charging the Romans for as far as conduct saying they did things and they needed a license to do those things next the doj says okay sure finsen said that about wallet providers they're addressing the motion to dismiss

where that argument was raised by the Romans defense Council and they say well the tornado cash service is not a wallet provider and there's a separate section of the 2019 finsen guidance that refers to cryptocurrency fixing Services I have a lot of problems with this argument a you can totally think of tornado as a wallet what was tornado cash for you put your money into the pool contract you are the only person on Earth that can take money out of the pool contract it's very similar to how a a a metaphorical wallet or a real wallet works you put your money in your wallet it's in your pocket you're the one that takes money out of the wallet setting that aside though it's true you could also think of tornado cash as something

like a mixer or a privacy tool the problem is that finsen actually did talk about privacy Tools in their 2019 guidance and they said that an anonymizing service provider this is their language who is accepting value from a customer and transmitting it to the same or another transmitting the same or another type of value to the recipient is a money transmitter again accepting and transmitting which means in the interim you have control over the funds and finsen went further and said an anonymizing software provider is not a money transmitter and they are in fact exempt from a licensing requirement so the doj makes a point tornado crh isn't traditionally thought of as a wallet so maybe Finn sends wallet guidance is

inappro or inappropriate but nonetheless finsen had guidance on exactly what tornado cache arguably was which is an anonymizing software provider and they said that's not money transmission this is a very nuanced legal argument I'm going to skip by this in my slides um finally this one bothers me a lot too consider the example of a business that accepts Parcels of cash from criminals and moves the money by corer to locations overseas the archetypal section 1960 violation the funny thing about this is well two things a courier that has a locked box of cash has far more control over that transaction than any of the developers in the tornado cash protocol

or even a large interpretation of who is part of the conspiracy if there is a conspiracy to do money Transmission in tornado cach so the metaphor is not even appropriate but even if the metaphor that the doj is using was appropriate armored car services that move funds from one location to another where the same person is owed the funds are exempt from licensing as money transmitters under finsen own guidance so even a metaphorical version of tornado cache that's like locked Parcels being moved from one place to to another on the blockchain for the owner of the funds which is a pretty good metaphor for what tornado cash is doing is exempt under finson regulatory Guidance the doj

doesn't seem to care they seem to just want to prosecute prosecute prosecute and ignore the fact that the regulator on point has actually said the exact opposite of what they're saying about the law for 10 years briefly the samurai wallet indictment I want to say two things about this one you may have seen some reported facts about the samurai devs there is allegedly a tweet where one of the devs said we welcome all our new Russian oligarch users don't do that this is not legal advice that you can rely on from me but don't do that a lot of this as I said has to do with intent standards was your intent to create privacy protecting

tools for the general good which I think is the intent of most developers out there or was your intent actually to further moneya laundry it's going to be very bad in court to try and say you didn't want to promote money laundry if you were encouraging sanctioned persons to use your tools that aside Samurai wallet was still non-custodial so the unlicensed money transmission charge rather than the money laundry charge is really hard for me to find a way to justify it doesn't make sense yes they ran a coordination server at least that's the allegation and I think that is how the samurai wallet worked though I don't have personal knowledge of that but even a coordination server for Bitcoin confidential transactions doesn't have

independent control over the Bitcoins being moved through that wallet finally the perv verdict the one thing I want to point out about the perv verdict and then I want to skip to questions so we have time to answer some questions is that this standard is extremely broad for who's criminally culpable for money laundry it's effectively a negligence standard and this prosecution under unlike the southern district of New York prosecution didn't even focus heavily on the existence of trusted or semi-trusted relay who are taking a fee it focused pretty much exclusively in the verdict in the actual like reasoning for why they're culpable on merely Alexis's failure to design software that had back

doors in it it's a negligent standard it says well sure you didn't overtly promote or induce people to launder money using your tool but you could have built your tool in a way that gave law enforcement a way to stop it or block people and you didn't and that's an incredibly broad standard that could trigger all kinds of criminal liability and really it's inappropriate for criminal liability to be this blunt object that states use to tell software developers the right and wrong ways to build Innovative new tools at least that's my opinion I'm going to skip through the rest of this so we can get to questions questions we have some time for questions uh so

please raise your hands if you have any questions yes yeah I think th those uh well developments are all um yeah not so great I would say what are there currently positive develop developments you see in in in so things that are making me more optimistic um probably the best thing to happen in the last week or so is that uh Senator lumus and Senator weiden which I know this is Berlin and I'm going to bring up American politics but a Democrat and a republican so it's not you know it's not partisan um wrote a letter to the

attorney general and said what is this unlicensed money transmission interpretation you seem to be arguing something directly opposite to what the regulator finson has been saying for the last 10 years and you're scaring the crap out of people who are building Innovative things and this is a positive development it's not going to carry weight in the southern district of New York but I think if the AG agreed he could back down I don't know if he will he could order the doj to to to cool it it has persuasive power also with the judge that people relied on this guidance for 10 years at the very least the Romans shouldn't be held criminally culpable because they relied in good faith on the on the statement of the regulator and maybe at the best the

doj's reasoning legal reason here is just bogus it's just wrong which is which is what I think so that's encouraging um I'm G to say this and I I don't know if this will get back to Ron weiden the senator one of the two senators but every time Ron weiden uh gets excited about something in the crypto space I feel a little bit more optimistic because he was a real hero in the early days of the internet in advocating within the Senate and the house before that for good policies that would allow devs to build a free and open internet and so he's not always like right there with the crypto stuff and I kind of get that cuz some of the crypto stuff is kind of ugly but he was right there for this and this is what

matters um the the Dutch case against Alexa PV um I know you're the lawyer but not our lawyer and also not a European lawyer but um can you compare the Dutch um the Dutch uh laws here with uh um other other jurisdictions around the world I mean it seems to me that this is an incredibly wide um and I mean you you might even I mean if the standard is NE negligence then it's really easy to kind of do this by mistake without without intent and without knowing that you're doing exactly so can you compare this to like other laws around the world I mean

this is Europe so uh yeah so so the one standard I can compare it to is the American Standard because that's where I have expertise so the Dutch standard is at least as explained in the verdict and again I'm not a Dutch lawyer but I can read a translation disclaimer is acting with knowledge that there is a significant chance that you will facilitate the concealment of criminal proceeds right or by your actions criminal proceeds will be concealed and so knowledge of a significant chance it's incredibly broad standard I I mean if I built almost any tool in the world

there's a significant chance that a criminal would pick it up and find a way to do bad things with it right so I just shouldn't build tools is effectively what a negligence standard creates from a public policy perspective in the United States money laundry is a specific intent crime it's not just a negligence crime it's a titer standard and specifically conspiracy to launder money which is what the Romans are charged with you have to prove that there was an agreement with a specific intent to further the object of the agreement now I think there was definitely agreement amongst the Romans and others to build good tools for privacy but did they have a specific agreement to facilitate money laundry I

think that's nonsense and further in the actual moneya laundering intent requirements you find that there needs to be specific intent to conceal specific proceeds of crime so it's very important to note that the tornado cach protocol was made the the Salient parts of the torado cach protocol were made immutable before all of the alleged criminal usage in the doj indictment so it's not even as though the most relevant parts of the protocol will built with full knowledge that North Korea is about to use it that's impossible they can't predict the future

and so I think it's going to be harder for the prosecution to meet their burden in that intense standard because it's not a backward-looking standard that says oh well you could have done X Y and Z and then the criminals wouldn't have had the benefit of your technology it's a standard that says no you you have to have had actual some specific intent to uh further the illegal act thank you so much P that was brilliant thank you