Episode 245: Sanctions against Tornado: a Legal Perspective

Transcript

welcome to zero knowledge I'm your host Anna Rose in this podcast we will be exploring the latest in zero knowledge research and the decentralized web as well as new paradigms that promise to change the way we interact and transact online this week's episode is a slightly different one so almost a month ago ofac a U.S government Department issued sanctions against tornado cash which is a privacy protocol that uses zero knowledge proofs to provide on-chain privacy it was the first time that ofac had sanctioned a decentralized entity for which there is no clear ownership so after the news came out crypto Twitter

was on fire with hot takes and dire warnings a number of people asked me to do Flash episodes right then and there on the topic but this show isn't a news show generally I like to do a recap or a look back when events like this have happened once the dust has settled and people have a chance to really digest what's happened but with this case the dust doesn't really settle and weekly we're still hearing about like Ripple effects from the action I think it's forced a lot of teams building in our community to figure out better where they stand and what they're building for I think we've seen some companies usually less privacy focused and based in the US who feel the burden to comply overstep their compliance at times at

the expense of innocent users I think we've also seen some ZK projects usually outside of the US and in an earlier stage lean further away from compliance into Realms that could bring more heat and attention from authorities so to cover this topic and since it feels like a deeply important topic for the show I will be doing a series we'll be releasing this every few weeks over the next few months these interviews will be with different members of the ZK community and hopefully through this we can understand how this action has impacted our community how different groups are reacting and what new ideas May emerge from this to start off the series with today's episode I decided to get a sense for what has actually happened from a legal perspective so I did two interviews for this week's

episode one is with v who is a partner and head of regulatory and policy at Bain Capital crypto she used to work at the SEC and the other guest is Michael from espresso systems who used to work at the treasury both at fincen and as I learned in the interview at ofac itself in these two interviews I spend time trying to understand what actually happened what a sanction is what kind of a tool is this why it may have been issued and what issues arise from the way it's been issued and how this might impact future understanding of zero knowledge Tech through a legal lens I hope this helps to shed a little bit of light into what has happened and maybe gives us a glimpse of what we can expect to see next before we start in with the episode Tanya will share a little bit

about this week's sponsor today's episode is sponsored by polygon introducing polygon ZK evm we all know that ethereum needs to scale and polygon believes that zero knowledge Tech is the best way forward polygon's vision for zkevm is simple developers can seamlessly deploy any ethereum smart contract to a layer 2 and benefit from the scaling power of ZK proofs it's also permissionless meaning anyone can use it and open source polygon ZK evm was built by polygon but it's for anyone who wants a cheaper and faster way to use ethereum without sacrificing security or decentralization they will be be releasing a public test net soon which will be an opportunity to test their work and make improvements if you'd like to join them for this journey or learn more about polygon ZK evm then go to

polygon.technology forward slash build on ZK evm and fill out the developer interest form that's polygon.technology forward slash build on zkevm so thank you again polygon now here is Anna's chat with v from Bain Capital crypto and Michael from espresso systems [Music] I'm here with tuang VI li who goes by the name V she's the partner and head of regulatory and policy at Bain Capital crypto welcome to the show V hi Anna thanks for having me on today our team at Bain loves collaborating with you and are big fans of this podcast so it's so fun to be here cool I recently met you when you were giving a play-by-play of what happened to

tornado and I thought it was so well said and concise and clear that I wanted to invite you on the show to show that in sort of like a wider way a lot of the information that we've gotten has come through Twitter and a lot of different takes and perspectives and some maybe news sources that don't always report things exactly correctly and I I thought it would be really cool to actually go over this again with you and see like a little bit more clearly what has happened that we know has happened um but I think before we do that why don't we start with a little intro tell us a little bit about yourself and and what got you interested in in this space at all sure so like you mentioned I'm uh at band Capital crypto where I had Regulatory and policy efforts and you

know that just means I advise our portfolio companies on regulatory strategy and then on the advocacy side I engage a lot with lawmakers regulators and others in the industry to push for good crypto policy before that I was the deputy GC and compliance officer at worldcoin which you may have heard of it's the the company with the orb which is by the way uh when I got really into ZK for the first time because ZK is a big part of how World coin works it's how they verify that a person only signs up for the world coin token once without having to reveal you know the person's identity and it's also how they make sure that the iris hash is never linked

to the user's wallet or transaction history and then before that I was at the SEC for almost 60 years as an attorney in the enforcement division where I worked on all sorts of cases involving Securities violations but including some of the first crypto investigations that the agency did and that's actually how I got introduced to blockchain and just became really interested in it oh cool I don't think that's how most people got into crypto but but it was an interesting sort of introduction into it like I remember reading you know satoshi's white paper at the time and just being super fascinated and then you know a couple of like YouTube video explainers later I was like totally hooked towards the end

of my time at the SEC I was also the chief counsel of the legislative and intergovernmental Affairs office where I helped oversee like the sec's engagement with Congress treasury the White House including it was last year so including you know a lot of legislation that touched on crypto policy so it was a really cool time and then before that in a more even previous life I was a lawyer at the law firm Wilmer Hale it must be so interesting to have seen everything from that perspective now that you're on this side um I'm curious like does it feel like very different work I mean in terms of like having to understand the technology and the

different players in the space like it's actually very similar because um you know as a lawyer in enforcement on the government side like you really have to understand and dig into that stuff to be able to investigate you know potential Securities Law violations and then you know to bring charges if it comes to that so in that sense no but I but I do think you know especially in hindsight I think my view of the industry was sort of necessarily very narrow right compared to like the way that I see it now which is especially being at a fund where you get to you get a lot of exposure to different companies building just across the ecosystem like I I think I have much more of a lens and

an appreciation for all of the different things that that people are working on and I and I don't know if lawyers on the government side get to see that and appreciate it um so let's start in on this on this topic um I think the place that I want to start is sort of defining who is or was tornado cash they were on the show so I will link back to that episode where we talked about the technology but yeah let's let's sort of just describe the scene of like who who is this group what is this thing as a lot of people probably know um tornado cash is a decentralized non-custodial privacy tool built on the ethereum blockchain uh using or it's

based on zero knowledge proofs and it allows users to break the link between their deposits and withdrawals of crypto so it was a company or at least an initial development team and they're the ones that created the smart contracts to do this but I think they've had something like thousands of contributors over the years and many of their smart contracts were finalized back in May 2020 including some of the smart contracts which we'll get into later that were included in the sanctions let's hear a little bit about kind of what's happened what are the sanctions maybe you can give us a little bit of a timeline of how this all rolled out sure so

um yeah let's talk about the sanctions everyone's favorite topic these days right so I think it's important just to just like have the context of you know what is ofac how do sanctions typically work so there's an office at the treasury Department called ofac the office of foreign assets control and the idea of ofac is to help protect our national security and foreign policy goals by going after the assets of foreign countries regimes terrorists traffickers Etc um and it's it's a tool like basically it's a way to fight our enemies without resorting to military action so one of the powers that ofek has to do this is the ability to add these types of

parties to a sanctions list called the specially designated Nationals list or the sdn list and once something is on this list that means no us us person including individuals U.S companies organizations or entities can transact with them and if you do ofat can find you even if you didn't know you were transacting with a sanctioned entity or didn't intend to that's what's called strict liability and that's what makes it really scary and very serious and then if if you violate sanctions requirements willfully they can also refer you to the criminal authorities and so historically the sanctions list has only included the kinds of parties I just mentioned right regimes

organizations companies and people but back in 2018 ofac did something really interesting which is that it added some crypto addresses to the sanctions list for the first time there were a number of Bitcoin wallet addresses associated with two Iranian individuals who are involved in a ransomware attack who are also sanctioned and as ofap explained at the time these addresses were added sort of as an additional way to help identify those individuals the same way you know they would include like birth date or an address or something about a person as opposed to being sanctioned as like an independent entity apart from their

natural owners since then ofactis added crypto wallet addresses as a part of sanctions in a similar way meaning they were added as addresses that were controlled or owned by natural persons including earlier this year when they sanctioned the centralized crypto mixer blender along with I think it was dozens of Bitcoin wallet addresses that blender owned or controlled so that brings us to the tornado cash sanction so what happened on August 8th ofac announced that it was sanctioning tornado cash for its role in money laundering criminal proceeds including over 455 Million worth of crypto stolen by the Lazarus

group the infamous North Korean state-sponsored hacking group that was itself sanctioned back in 2019. So what's interesting and novel about these sanctions is that along with quote-unquote tornado cash whatever that refers to the tornado cast website and a number of ethereum wallet addresses ofac also sanctioned a number of smart contracts that aren't controlled by anyone so they essentially sanctioned a software tool so ofac doesn't explain why these were included and doesn't say anything in the press release to suggest that it even recognized that these smart contracts were categorically different than crypto addresses that that had been

sanctioned in the past which as I just mentioned have always been aliases of or controlled by natural persons or entities so that's the first thing that's unusual about these sanctions the other part that's led to a lot of confusion is the why so here's where a lot of the headlines and Analysis I've seen have been inaccurate or imprecise as to why exactly tornado cash was sanctioned and I think it's always really important to carefully read the language in like the order itself right so if you read the press release it says a few things it says tornado cash was used to launder more than 7 billion worth of virtual

currencies since its Creation in 2019. so the way this is worded is actually really confusing if not outright misleading right because the statement makes it sound like all of this money was dirty but actually the 7 billion just refers to the total amount of funds that have flowed through tornado cash since it was created including possibly a majority that were actually listed transactions ofac doesn't specify how much of the 7 billion were criminal proceeds and like I said the way it's written it seems almost like they're trying to give the impression that all of it was dirty right because the word launder has an inherently criminal meaning yeah you know I recently saw a chain analysis report I think from July

saying that like only 23 of the funds that go to mixers are from illicit addresses so there you know there's obviously an issue with the way that this is worded and then the Press press release goes on to say treasury is sanctioning tornado cash a virtual currency mixer that launderers the proceeds of cyber crimes so they just said that tornado cash was used to launder criminal proceeds but here they're saying tornado cash itself is the one laundering so which is it these two statements to me seem to conflict and at the very least are confusing and then at another point in the press release it says tornado cash failed to

impose effective controls to stop it from laundering funds for criminals okay so now it sounds like we're back to them saying not that tornado cash itself laundered money but that it should have done more to stop others from laundering money and it didn't yeah so now it's being sanctioned in other words it may or may not have been their intention but they were basically facilitating money laundering so why does it matter precisely why tornado cash was sanctioned right it's it's because you know it tells you under what circumstances you could also get in trouble so it's important to to be clear and to get this right and you know representative Tom emmer recently wrote Oh faculture asking a lot of these same

questions um that all of us have been asking so I'd really encourage folks to check that out and and hopefully we get some more guidance or answers from ofax soon interesting so that question of does tornado do it itself or does it just allow others to do it this does seem to be like this confusion point but I think like would there be be different implications if tornado was doing it itself versus allowing others to do it yeah I mean I think if if tornado cash was itself laundering money which I I mean I haven't seen evidence of that and the press release is confusing um but I don't know if that's what ofac meant to imply or suggest but you know if they were themselves laundering

obviously the sanctions are much they make sense right like then it's much more like a you know Hydra Market or something which is that crypto Marketplace that was sanctioned a while back but if they were merely facilitating money laundering meaning you know they created and deployed and maybe to some extent still control or administer or have control over a tool that allows others to money launder then I think it's a much harder question um legally speaking and then in terms of like what it means for others in the industry right like other crypto projects out there especially the decentralized ones like could they also be seen as facilitating money laundering

or criminal activity or sanctioned activity by virtue of having created and or deployed and or like if they're controlling or operating some sort of software tool um so I think that the implications are really interesting and and I think it's it's a difficult question if it's one of facilitation I also think I mean another Point here is who are they like I think when we think of this project and once it's deployed I mean I know that there was a Dao and there was a number of people who could make kind of like protocol level decisions through a voting mechanism and so this is where

it's like who are they to kind of go after would you go over after members of the Dao are they then the controllers or is it just the cree the company who created it or is it every single person who's ever interacted with it because in a way tornado is weird because it's like the thing that makes it effective at hiding things is the fact that a lot of people are using it so yeah I wonder if if you've had any thoughts on that yeah so that's the really interesting thing about mixers right is that the more popular they become with legitimate users the more attractive they are to illicit actors because it makes it easier for those people to hide their dirty money when there's more clean money in the pools

and so um you know unfortunately I think that's probably what made tornado cash a target for the government is that it's become so popular with both legitimate and then illicit users and so you know I think the question of facilitation and who exactly can be held liable if like a protocol or a tool is used for illicit activity and and results in money laundering or sanctions violations can be a really difficult one when you're talking about decentralized protocols right so you know when we're talking about that I think it's really important to distinguish between a front end which

may be controlled or maintained by a group of people and the protocol itself which may just be smart contracts that operate autonomously on the blockchain and which in many cases including with tornado cash can be accessed by anyone in the world through any number of third-party interfaces and often the team behind the front end has no ability to alter those smart contracts anymore so that was actually the case with most of the tornado Cash Smart contracts that were sanctioned once they were finalized in May 2020 and deployed no one has been you know has had the ability to modify them or even remove them including implementing any kind of screening or blocking mechanism basically they'll

continue to run for as long as the blockchain they're on exists in in this case the ethereum blockchain so you know this is a Nuance that ofac may or may not have appreciated but the fact is is the sanctions regime was designed with centralized entities in mind and a lot of us are hoping that the way that ofac went about this was based at least in part on a lack of appreciation let's say for how these decentralized protocols work and the extent to which an actual person actually has control over how the tool is used which you know would be good in a way right because I think there's an opportunity there to engage with them on the nuances and to make

sure they understand the difference between the different types of decentralized protocols and a lot of us in the Regulatory and policy Community have been working really hard to do that on the other hand if ofax intent was simply to make it as convenient as possible to use the protocol and drain it of users that way then I mean that's probably going to work right like most people aren't going to start running their own ethereum node and use the command line to access these D5 Services right and then sanctions also have the impact of just casting a cloud over the entire thing which is devastating for a mixer because the more quote unquote clean money exits the system the more all money exits and your toast so I

think in a lot of cases and especially for mixers even if only the front end starts censoring and people can still access the protocol through third-party means you've effectively killed the protocol given the fact that ofak has done what seems like kind of like a a broad stroke action is this something that you think the community needs to see is like a final say or do you see this as potentially being challenged or rolled back eventually you know I I think elfac and maybe others in the federal government were very concerned about just the National Security implications and I think rightfully so right if there was a significant amount of money

laundering happening through this tool then then I think it was reasonable for them to Target it even if they may not have appreciated all of the implications so you know I don't think they're gonna like roll the sanctions back or anything like that hopefully what they'll do is issue some FAQs to sort of clarify you know given that tornado cash and especially the smart contracts are decentralized like what what does this mean for other projects out there in terms of complying with these latest sanctions um what should they be screening for blocking for how far do they have to go I don't know how much detail they'll go into on that front but hopefully they

will issue some guidance to give um you know people in the industry more clarity about what they need to do to to avoid getting in trouble and you know so for companies that are already regulated by treasury fincen as what's called a Money Services business they're already required to do things like kyc their customers have an AML compliance program all that good stuff because they have to comply with it being secrecy act and although it's not strictly required by that act they'll typically also have some sort of sanctioned screening in place companies like coinbase so for them it's relatively straightforward I would think to screen for additional sanctioned addresses or transactions because they generally know who their

users are and where funds are coming and going not in all cases but for the most part it's much harder for decentralized projects or protocols that don't already have these things in place right and that could include both regulated and unregulated projects by the way for example circle is regulated but they don't have customers and accounts the same way a company like coinbase does so I'm not sure what sort of kyc they already do or are going to do they do control the usdc smart contracts though so I suspect that even before tornado cash they were already screening for sanctioned wallets that interacted with those smart contracts I'm not sure but what we do know is that after tornado

cash they begin freezing usdc that was held in those sanctioned wallets and maybe even in wallets that interacted with those wallets and so on but you know they have to decide how far beyond the address is uh that are strictly on the sanctions list they want to go just as centralized crypto companies like coinbase will have to I think the harder question is what do companies that are decentralized to some degree what measures should they Implement and what measures like are they even capable of implementing right to minimize the risk that they're interacting with sanctioned wallets or being used by others to do so you know we talked about front ends front ends versus the protocol itself earlier so

um if there is a front end over which some people have control and are us-based like you know what should they do right so the most straightforward thing you can do is screen for the wallets that are on the sanctions list so you hire one of these like compliance providers like trm Labs or chainalysis and Implement their sanctions API and your front end which then blocks sanctioned wallets from accessing the protocol through your website or app or whatever interface you control you know but the question that the tornado cash sanctions raises or the question it raises is is that enough so one thing that's been confusing about the sanctions against tornado cash is that tornado cash itself had actually been doing just that back in January

it was reported that they had begun using chain analysis to screen for the sanctions list uh and the way that their quote-unquote mixer works is that they also provide a cryptographic note to each depositor that contains information about the origin of the funds in case law enforcement ever needs to access that information but they still got sanctioned right so what does this tell us does it tell us that it's not enough to Simply screen for the sanctions list and if so like what more are you expected to do yeah yeah that that fact that the viewing key because I think there's two things that most privacy projects had always sort of relied on

that was like decentralization and having this viewing key they did have both yeah and still got this this sort of action and that definitely does raise the question of like what else to do to make sure that you're compliant to make sure that but also I mean I guess also to make sure that you don't have lots of crime like maybe I don't maybe there's like a like a technical or a product idea or solution that's also out there to protect for that those are the questions that a lot of D5 projects are struggling with right now right how far they expected to go and how much backlash are they willing to tolerate from their users uh and again to the extent that they only control a front

end can they still get in trouble for stuff that happens on the protocol outside of their control which seems to be what happened to tornado cash assuming that ofac understood that no one controlled some of these smart contracts that were sanctioned the other possibility I've seen raised is you know should you be building some sort of screening mechanism into the smart contract itself and can you be liable if you don't and the smart contract is later used to say laundry money that obviously doesn't address the issue of the smart contracts that are already out there and immutable but to be honest I actually can see a world where the government eventually says you know if you're not able to build something that

doesn't have the ability to keep out Bad actors then we can't allow that thing to exist because it simply presents too much of a national security risk were to happen I think it would be done deliberatively and explicitly in fact probably legislatively not through enforcement so to speak so I don't think that's the message ofac was trying to send with the tornado cash sanction and in fact I think they've been surprised that it's been received that way can you share a little bit about sort of some of the reactions of the big players like usdc and circle also I mean I had recently the flashbots folks on for Mev and sort of the software that they're

running I don't know if you've seen like if you've been keeping track of all of the reactions of these companies that are often based in the US but yeah I'm just curious like is that is that Overkill are they going kind of too far like I've heard that you know in some cases they've they've blocked all addresses or they've thought of blocking all addresses that interacted with it at all even if it's in the past yeah that's that's actually a question I have with respect to like some of these compliance providers I don't know that they have the ability to do like time-bound like screening right because sanctions requirements are not retroactive meaning they only um go into effect or they only apply to

transactions that happen after the sanctions are announced right so it's obviously problematic if these screening tools don't have the ability to filter that way um so I I don't know if you know you've spoken to to someone who has more familiarity with the way these tools work but if that's true then that's obviously a problem that would be more expansive than what the sanctions requirements require you to do so one thing that really emerged right away was this idea of like usdc being frozen and that this decision had been taken can you share a little bit about what actually happened there like who froze it and what did they actually freeze sure so circle is the the regulated company behind the stablecoin

usdc you know and they froze the usdc in certain wallets that were sanctioned or had I think interacted with sanctioned wallets I don't know how far out they went but a lot of usuc was frozen after the sanctions were announced and circle said that it was actually Center or santra which is a standard setting Consortium between Circle and coinbase that made the decision to do that but was this more than ofek had asked for actually I I don't know actually they didn't say that I think it may have just been a decision that they made um okay you know every company has to decide how they're going to comply and what their risk tolerance is and I think

Circle being a regulated entity it's it's something that they have to take very seriously what do you expect in terms of like legal feedback to be happening right now like it will there be cases will there be I don't know like requests for clarity like what kind of action can actually lawyers take now or groups take at this time so it's not at all unusual for companies or or persons who are wondering what they need to do to comply to reach out to ofac directly and that has been happening these past few weeks and so I think ofac has heard players from the industry loud and clear that

there's a lot of confusion around this projects and and companies aren't sure exactly what they should be doing how far they need to go um so I think there's there's been a lot of Engagement and like I was saying earlier I do expect ofac to issue some guidance and to answer some of these questions um especially because you know like I said representative Tom emmer actually sent them a letter with very specific questions about what the sanctions meant um so I would expect a response from them on that I mean I think this whole incident has been really interesting the thing I would leave you with is you know a lot of times when there's like a seemingly heavy-handed and confusing

government action like this especially when you're talking about sanctions where it's strict liability you know and the consequences of violating sanctions requirements are severe the danger is sort of that everyone around you starts to self-censor they panic and and go overboard right so I think the priority for us right now should be to you know help educate the government about the positive use cases for on-chain privacy and you know talk to them about the solutions that a lot of people are working on right now as you know right including a lot of ZK based solutions that potentially offer a better way of complying while also preserving privacy and this isn't just about mixers it's

about D5 protocols more generally it's about self-hosted wallets and so on and you know it's always hard to get the government to change the way that they've been doing things for ages but we we need them to understand right that blockchain by its very nature of being entirely transparent and public just it can't survive or reach its full potential without some element of privacy for its users and I I also wanted to say that you know I know privacy is the focus here but if we're going to talk about you know what sorts of compliance measures we should Implement across different parts of the crypto ecosystem I think we really need to stop and consider

the current system of like kyc and AML that we have here and around the world and like why it's so deeply flawed right one of the reasons it's so flawed is not just that it's a privacy nightmare but also that it shuts out so many people like one of the things that Drew me to crypto maybe you two and I know a lot of others was the promise of a new Financial system that was a lot more inclusive right like over a billion people around the world lack any form of government issued ID and in a lot of places companies simply choose not to serve these unbanked or underbanked populations because it's just too costly or risky to do so under our current system of compliance so I really think

we need to ask ourselves like why would we want to perpetuate such a broken system one that was originally designed for centralized entities why would we want to import that onto this completely new and different system that's premised on decentralization and that's supposed to give access to to more people not less like this is our chance to reimagine a better system of compliance if that's you know what we choose to do and one that not only makes sense for how blockchain actually works and how decentralized systems actually work but also one that's more inclusive and less costly and of course more protective of privacy and security and so I think that's the exciting opportunity we have here and we should do it in a way that's

thoughtful and measured and and not based on like Panic or you know knee-trick reactions V this was so well said I just want to say thank you so much for coming on and sharing this with us I also really like the framing and how this I mean it's it feels maybe like a darker time in the ZK space or the Privacy space but it could be an opportunity to really understand the parts of the system that need fixing and need Clarity and try not to bring with us some Legacy stuff that really you know that should be left in in history so thanks again for that of course it was so fun to be on and to chat with you about this thanks for having me foreign

ER The General Counsel at espresso systems welcome to the show Michael thanks Anna great to be on with you so we just went through a play-by-play of the tornado cash ofac sanction uh in the previous part of this interview with v so for this one what I'd like to do is talk a little bit more about the different kind of regulatory bodies that exist in the U.S maybe we can actually talk a little bit about an international perspective on this as well and then I want to talk about opportunities for zero knowledge Tech in the context of some of these regulatory bodies because I feel like obviously a lot of the dialogue right now is focused on the risk or the way that there's a conflict

between their goals and the goals of privacy Tech but I know that there's a lot of opportunities absolutely so let's start off with first of all a little bit about you so tell us a little bit about your background and what led you to work at espresso and on zero knowledge Tech sure so I'm yeah I'm the general counsel now at espresso systems which is building uh configurable scalable privacy with auditability and selective disclosure applications to it but um I was most recently before this in the government I was the acting director of fincen which is the treasury's financial crimes enforcement Network and that's a combination of the financial intelligence unit for the

United States and it's also the administrator of the What's called the bank secrecy act but it's basically the primary money laundering Authority for the United States and and to your question about working with other agencies they also delegate certain aspects of of the money laundering authority to like the SEC cftc and and the banking Regulators but overall administer that and before that was the deputy director and the first digital Innovation officer at fincen which was also driven partly through what you mentioned which was getting a handle on sort of emerging risks from from digital Innovation that was happening but also on opportunities like digital identity

zero knowledge actually proofs which we can talk more about later but that was something we we were actually encouraging and setting up some Innovation around and then before that I was at chain analysis and was their first in-house counsel and had gone there out of Treasury also where I was at treasury's office of foreign assets control which actually is the sanctions arm and there I was the associate director in two positions one was sanctions policy and implementation it's a separate office and then another office there that I was also associate director for was the office of compliance and enforcement and spent some time as the acting deputy director as well during some Administration

change and before that I won't go through everything but I was at the I'm very old so me too but I was uh I was at the Department of Justice in the money laundering section I was deputy chief there and and did a tour at the White House National Security Council and the Obama Administration I was the director for transnational organized crime and started everything at the Manhattan District Attorney's office as a prosecutor coming out of a law firm where I actually had done a lot of pro bono cases for victims of domestic violence and after working with with victims of domestic violence to get protective orders decided I I just needed to be in public service full-time

there's a lot of bad stuff happening and exploitation of people which also winds through to sort of crypto and sort of you know empowering people in fact a lot of these cases that I worked on that it was certainly physical abuse but there was also Financial abuse and control that was happening and there is a in fact we've talked about that as a use case of sort of if there's ways to get and it would have to be privacy preserving um for sure but privacy preserving ways to get financial assistance to to victims of domestic violence that are fleeing abusive relationships um I mean it's a it's a crazy fact I don't remember the exact date but but actually in the U.S like women

literally could not get bank accounts without husbands approval until like the 70s to like the 70s crazy it's like mind-blowing also like Hospital stuff like I think my grandmother was not able to like make decisions about the children oh for sure I'm sure that's so crazy yeah yeah yeah it's like and the dates on these you think it's going to be like the 1570s but it's like the 1970s um but there's there is like there's a lot of control happening and that was and that was a big driver to get into public service but it's also a Big Driver where Public Service actually does dovetail really well with sort of personal sovereignty issues and and

certainly democratization um but counter exploitation too like there's the whole point is not just chasing bad guys it's actually preventing the victims to start um so and we can Circle back to that in terms of some of the applications that governments looked at too and things that that I worked on but you don't I mean especially from doing for prosecuting violent crime cases and and working with victims like somebody somebody once said after a case you know it's not a reporter asked this prosecutor like hey you won like like are you happy with the Victory and the prosecutor was like no like like every conviction is a tragedy it's like it's a personal tragedy for the person

convicted but it's also they're a personal tragedy for their family it's a personal tragedy for the victim I mean you don't nobody walks out of these cases whether it's physical or financial exploitation cases feeling like great there was a conviction I'm all set you know like once you've been violated in that way whether it's Financial or physical or whatever you're not going to just like get get everything back you might get some of the money but you don't get that feeling of safety or control back and I think that's a a big part of of why AI well that's invented you want to prevent it and that was and that was also a big draw to Espresso systems for me I was acting director of finson at the time and and uh had the

opportunity to stay on but met Jill Gunter and uh who's been on the show is yeah he's amazing and and Ben Fish and Benedict uh Boons and uh and just also on the show also on the show awesome yes I'm happy to be in their footsteps uh as I was coming into espresso and um you know it just this was this was configurable privacy that was gonna I feel it has the potential to really Empower people but also have an opportunity through zero knowledge proofs and selective disclosure to empower people to also manage counterparty risk I mean I think part part of it is that Beyond like forget about regulations there there is a point where people don't want to necessarily buy their

house by putting cash in a brown paper bag on a on the front porch like the the you do want to manage counterparty risks in some ways but it but it doesn't mean that you want to put your social security number everywhere in your home address yeah so let's come back to the sort of use cases or future uses for ZK stuff because first I wanna I wanna explore a little bit about what you had just shared about your biography and having worked in these different organizations when you said you worked at Treasury and then you worked in sort of the crime and like kind of area of that something I just realized is I don't actually know where ofac is possible that in the previous interview

V did say it and I'm blanking but like first of all what does it exactly stand for and where is it yeah that's a great question actually it's um so ofax stands for the office of foreign assets control okay and it is it is a component within Treasury it is in Treasury and actually ofac and Vincent are two components within treasury that are separate Standalone but they're within Treasury and they both report to the same undersecretary for terrorism and financial intelligence which right now is is Brian Nelson uh so they so they are very connected okay for sure and sec is somewhere else SEC is a totally Standalone agency so more of a counterpart to treasury with

far more resources I will say also but um but yes where do the resources come from did they all get funded by tax for all of these things or is there like private ownership or like what how does it actually work no it's it's largely tax it's taxes and and there's an element of certain penalties that might go into the into certain forfeiture funds and like whether it's from whistleblowers and other things but most of those are not they mostly get paid out if it's a whistleblower they get paid out to the whistleblowers or to enter the victims of course um and the priority of all those is going out to the victims but you there are some like massive money laundering cases like there was a big HSBC and BNP parabok

cases um where like the HSBC one they were it was like literally suitcases of cash that were being handed across the counter in Mexico um they've they're not doing it anymore I'm told I'm not I'm not getting it sued but um but some of those big fine cases a portion of that can go to the treasury forfeiture fund but not a lot and and I think it really gets put back into the national budget um and go into victims of any of any crimes and the point is that you don't want to actually incent over incentivize public service to collect fines just to be able to buy computers and that sort of thing like you want to go through the budget process so yeah um so there's a bit of a push and pull

on that interesting yeah when you said you were working at treasury you were always at fincen you were never at ofac right no actually I was at ofac you were okay before I was at Vincent Yes I was um at the Department of Justice and then I went to ofac um where I was associate director there interesting so I did do an episode with Peter from coin Center two years ago or something where he did actually map out a lot of these different groups so I will add that link to the show notes but now I do want to explore a little bit more what's going on in ofac itself I love that you have worked there I actually only knew that you'd worked at

fincen and this is really interesting to me what's it like in there what is a case what does it look like and how do decisions actually get made inside yeah that's a great question actually and and I should say in between all this I actually did spend some time in the targeting side of ofac right out of the Manhattan D.A and then quickly went to justice so I've I've built what does that mean what does targeting mean actually that's where they actually build the case Okay um that will say like for instance um one of the things I worked on was Somali piracy so it was uh these they were these pirate groups up in in Somaliland uh that were um taking boats hostage and and and demanding ransoms and we were trying to

figure out um okay and arms dealers related to that uh for sure like the classic Victor boot arms dealing Network so you're trying to figure out who's who's moving money and who's supplying arms to conflict areas or in this case um where where who's funding the piracy you know to get the boats that they need or the ladders or the arms and then also where is it going is it going to corruption in local corruption or is it going to warlord somewhere like what's what's behind that and so you're You're Building evidence in that case we worked with the actually with the UN monitoring group um we worked with ngos um that were on the ground dealing with like Aid that was getting diverted to find out like who's extorting Aid and

all of that builds into sometimes it's a network like in arms trafficking you're looking at the networks like Victor boot but you're also looking at who are the financial facilitators and what are the touch points so that you can impact so it's it's I should be clear like in Department of Justice it's you're you're Prosecuting for criminal violations it's it's punishment like just to be clear like it's that's what it is um ofac is set up is designed to be a behavior change mechanism for National Security and foreign policy goals so it is not meant to be punishment the the goal of it is to change a political calculus like Russia invading Ukraine um Crimea or authoritarian regimes like

like the military Junta taking over Myanmar and washing Democratic elections and so a lot of that engagement is like look we're gonna slowly in certain ways create economic resistance for you will will calibrate that to be to increase it or decrease it based on like whether you're getting closer to democracy and allowing elections and the whole point is to turn it be able to turn it off and so um so that is different and the legal standards are different because of that as well as constitutional protections because it is designed to be under the international economic emergency Powers Act to be basically foreign located so you're you're not designating U.S

persons they take enforcement if us persons aren't minding the sanctions but you designate foreign entities it's always foreign so it's like when you get on that sanctions list it's always out non-americans on the sanctuary if you were to engage and then didn't get caught could you as an American get put on it I don't know that there's any American that's ever been put on the list I know there was some discussion of a of someone at one point I have to be careful about this but that was like you know became a foreign terrorist and there was debate about that um but in general they don't because you that you have due Pro you have constitutional due process rights as an American that would not really allow for

them to just suddenly freeze assets like you would have to get notice and ability to to dispute that that sort of thing and so I mean there's still an appeals process for anybody that's put on the list but but but you would actually serve that in fact there's been issues where somebody was flying over the U.S uh or flying in when you're gonna designate them and do we need to go read meet them at the airport and give them notice that sort of thing uh there was some some money launderers actually from Central America that that happened and so it is always calibrated to be you can get off the list it's not forever um and and that's a sort of complexity when you talk about a smart contract and I should say like one bit of history on

ofat because it's I think it's important also in thinking creatively about like what the point of this is but also what's possible is it has roots that go all the way back to the Civil War in some forms but it wasn't called that wow looking at who was giving Aid to the to the Confederacy and stuff like that and embargoes around that but it but it really came to four in the um World War II and it was and the reason it was called the office of foreign assets control ultimately was that it was actually freezing assets that had touch points to the us when the Nazis would go into countries and start taking over so like the Nazis would invade like let's say Denmark and there would be Danish government gold at the

Federal Reserve or somewhere in the U.S and ofac would actually freeze assets the foreign assets that were in control of U.S banks or in the U.S system so that the Nazis couldn't take it out um and you had to have you had to use an authority you can't just say I we've decided someone we don't like is there it's like you need an international economic emergencies uh act power and an executive order to declare a national emergency and say so it was really preserving assets like it certainly is used and it wasn't like the Civil War version of it was was an embargo against you know those that were funding the Confederacy so it always had a had a sort of behavior change mechanism but it also has a protective function and there's been other uses of

that in more modern time including you know in Libya during Gaddafi regime change and uncertainty where assets have been sort of protectively Frozen so that somebody didn't just come in when there's a dispute between who's the real Central Bank and stuff like that or if there's looting that sort of we're gonna freeze the assets in U.S control and when it's resolved we'll we'll sort of let those go again so it does have a a protective it's a multi-faceted organization how does a case start so you sort of mentioned this targeting what actually prompts even that what's the step before that that it becomes like highlighted or flagged yeah it's a mix that's a good question because it's a real mix like sometimes it could be

like when I worked on Somalia the global supply chain was getting jammed up um and obviously and people were being held hostage and their conflict there was there was a lot of concern about al-shabab um which was which was wreaking havoc in the country that they were getting funding from the Pirates and it wasn't clear if they were really working together or if they were just getting protection their money from them or what it was and so it's always fundamentally tied to a National Emergency because the president is declaring in a National Emergency on whatever the issue was and so in there the president declared a National Emergency involving Somalia that was for the terrorism that was destabilizing the whole government and terrorizing people and then also

included the piracy that was terrorizing people but it was also funding al-shabab but it was also disrupting the global supply chain would this have been highlighted partly through like the media or was it like how like who reports it yeah people call the government and be like something's happened my business has been been robbed or like is there my boats like who's telling on like who gets them oh yeah it's a mix like it's not that like they're they're tiny it's a tiny tiny organization so it's not they're not that sort of able to be responsive to private actors that much although they will certainly get information from like political dissidents under an authoritarian regime that's that's like hey this person just escaped from Evan prison in Iran or or wherever or the

military Hunter and Myanmar and has information about who's causing the exploitation something like that but it's generally these are presidential Declarations of emergency so it's it's a mix of geopolitics the state department um the there are there are analysts at treasury that are constantly monitoring crises and the intelligence Community certainly in law enforcement so something like Somalia you're seeing the state Department's talking about it foreign partners are talking about it ngos are coming to us saying we cannot deliver Aid and some of those are like the world food program that might be partly funded through usaid so you're hearing it from all sorts of touch points and the UN itself sometimes

something like Russia's invasion of of Ukraine you'd be hearing it from the intelligence Community like well before the news and you'd start working up what are the pressure points um what can we actually impact because the other thing is they have very limited resources and you don't want to spend a lot of time just putting names on the list that aren't going to be impactful because each name that goes on the list is a full legal package of yeah here's why we believe this it's here's multiple sources that you know it's not just somebody says they've seen bad it's it's a legal review so you can't just you don't want to be putting names on that you can't impact I want to bring this to the tornado case because now I want to understand like

was there a directive from the top that like crypto scary bad or was it more like North Korea never like what was the what was the rule at the top that led to this yeah that's the question I I don't know uh it's not that's not public so we don't know and I oh that's it's never public so this is something non-published this is not known necessarily right what you have that's public is whatever the press release says um and people will do sort of Freedom of Information Act requests but those can take a long time to come out and they're not going to put sensitive information out okay normally if you're now if you're like the person named you have an

appeal right an appeal process and you you would normally write in and ask for more information which it would be up to you whether you'd make that more public or not but if you're challenging it um and they're not going to just give you the whole file there might be sensitive sources involved in that including by the way in in like Global magnitsky is a is a sort of Human Rights and foreign corruption Authority and and they're not going to just reveal like here's the human rights actor that told us about you uh lukashenko or whoever um just because you appealed they're going to protect you know human rights actors and that sort of thing but um so you won't necessarily know what what I think we glean from the public statements is that it was largely driven by the the amount of money that was

going to North Korea and actually going to North Korea people weren't like fundraising through tornado cash it was North North Korean cyber hackers that were sending their money to the smart contract to to try to obscure the tracing so that they would have a better chance of trying to cash it out at centralized exchanges because the reality is there's not a lot that you're gonna buy they aren't going to buy centrifuges in North Korea with Dogecoin or even Heath yeah so it does seem from the press releases like very North Korea driven uh and then looking at the numbers it was in sort of hundreds of millions to a billion couple billion that were related to these hacks and so that's in the scale of North Korea's

economy like that's an enormous amount like in Tradition North Korea it was it's like coal smuggling and ship to ship transfers of oil and yeah actually yeah I don't know I don't want a tornado hit out they're still looking for an off ramp where's the off ramp is it in North Korea is it like in American accounts I don't know maybe there is reporting on this but like I don't actually know where this crime goes how do they like how do they use the money yeah that's the big question uh I don't have anything access to anything that's not public I'll say that um but I but I think part of the issue I think how this Rose was like obviously they're not the US government is not interdicting money at tornado cash

they're not they can't seize it at tornado at the Smart contract level because there's no admin key um so they're not interdicting it there so it's really North Korea is trying to get it to a centralized exchange somewhere probably it could be OTC desks somewhere in Asia um some of it could be Russian or other centralized exchanges um that don't do to any sort of AML or kyc and and then others could be this it's not hap it's not us exchanges um but they're trying to get it to a fiat currency that they can use and so that and that also by the way will sort of determine where they're going to go because if they're looking for Chinese Yuan they're not going to come to the US or even Russia necessarily they've got

to go where there's liquidity particularly at the amounts we're talking about could ofac have actually targeted those exchanges or they know so little so they didn't know which ones or like yeah like that's been another thing to do yeah that would have been my first thought uh having having also spent time there I think it's a combination so yes like you're you're always gonna on some level have one better chance of changing Behavior if it's a centralized actor and also you're gonna get closer to where you're sure that it's going to cause impact because it's it's it's the place they need to get to um whereas something like tornado cash is just one one means one step on the

way it's one step on the way um but my sense is probably from the press release you know where they're talking about the amount that was going through that it just got to a point where yeah we don't know all the OTC desks that get used and and you're probably getting some centralized exchanges saying hey you know I'm doing my thing here but but if they go through a mixer I can't always tell so don't hold me accountable you know even though the reality is it's not they're not sending this through coinbase and Gemini and Kraken it's going to foreign exchanges yeah there may be all sorts of regulatory Arbitrage going on um and there may be engagement with those centralized exchanges that's happening that's not public because you don't in a normal situation it's a

pretty high bar to actually designate a financial institution like if you look at the history of ofac there's very very very few actual financial institutions or exchanges and I include exchanges in that that have ever been designated because the collateral impact is just so High um I think the bank of Delta Asia was a 311 Action which which won't go down that row habit hole but it's a fincen version of sort of um of sort of this but there's been very very few when I was there there was one A Bank in Honduras that was it was largely controlled by money launderers but even there there was extensive guidance very quickly and and wind down licenses saying we know that not

everybody that Banks there is is a money launderer and you can't just stop people from paying mortgages or getting their salary or paying their electricity bills and so it's a really heavy lift and it's always an analysis of collateral Impact versus how much you can actually impact the bad actor and and that makes it really really rare for like there's been a handful maybe at most and they were largely like controlled by Bad actors not just used by them um so it's it's a rare like you would much more likely have engagement you know threats on it potential enforcement because you can take enforcement and fines where you'd use fincen authorities which are which are a little lighter because they they cut you off from the

U.S financial system but they don't necessarily freeze assets okay which is a bit of a Nuance but but it's a pretty exceptional step what they did yeah and normally you would you would quickly have sort of some sort of frequently asked questions guidance General licenses out that would say okay we get it like even by the most sort of aggressive you know chain analysis trm elliptic looking at uh I should say the most aggressive numbers uh not that those services are aggressive uh the most aggressive numbers it's like you know 30 maybe up towards 40 that has some historical ties to elicit and sanctions although chain analysis was quick to clarify that when they said

that it's roughly 20 were tied to sanctioned entities most of that activity was tied to entities before they were sanctioned so it wasn't actually a ton of it and there was some for maybe 10 or so from hacks so you still had like 70 to 80 percent potentially of totally illicit legitimate use maybe the worst case 60 but that's still more than half of all these people that have assets that one it's it's a smart contract so North Korea can take their money out whenever they want like the the sanction doesn't change that remotely so if you have your receipt you take your money out but if you're a US person who one is your salary paid through there because you didn't want everyone in the world to

know every time you got paid you're sitting there with the key to your lock box that you're anxiously not using while your mortgage is coming to because you're thinking I'm gonna get I'm going to have an enforcement action um for using this thing and so that's the kind of clarity and guidance we're looking for hopefully very quickly and and normally that happens pretty quickly I'm gonna go just one step back on the like sort of how ofac works because I'm just realizing that it's like you'd only sanction foreign but you'd only punish Americans for interacting with it generally that's so interesting so it's like it's like against everyone outside but like the only like so anyone outside interacting with any of those are they

actually endangered as well well yes I'm Canadian no I'm not planning on doing anything like that but I'm just wondering if I did does America care because I thought it's just for Americans uh America always cares in in a good way in a good way um but yes so it follows like all General well it's it's two things it follows general jurisdictional principles but it also has some additional authorities related to this so the most immediate sense enforcement would be U.S persons you may not uh send money to Iran the Iranian government let's say um but it also follows personal jurisdiction which is which is every

country has versions of this which is if you purposely Avail yourself of the U.S jurisdiction we expect you to follow our rules too so you might be Canadian but if you're doing business here regularly and like let's say you you have advertisers not trying to make the case against you but you shouldn't use me as an example let's not use you let's not use it Anna's completely cut off from the U.S no ties but let's say let's say a hypothetical entity a business or a person is doing business with the US would would that mean this is actually this speaks to another kind of question but like so if that person's interacting with someone on the sanctions list potentially an address are they then sort of sullied themselves are they

Untouchable to an American even if it's one step away yeah and that's the part of the issue that so let's say you're you're somebody outside the U.S but your wallet has inner interacted with the designated smart contractor addresses there's almost no chance that you're going to then head over to Kraken or coinbase or Gemini and just cash out anything um and part of the issue because of the transparency and the sort of long time immutability so you're seeing everything you're now going to be from someone like chain analysis or trm or elliptic they're constantly doing risk scoring and so yeah you're probably the address is going to come into the exchange in the US it's not it's it will say if it

was a direct contact or not but it's still probably going to get a risk flag even if it was a couple steps away wow and and then the question for like a coinbase or a Gemini is okay now what do I do with this like I have an indicator of risk I don't know if if this person was like money laundering or if they it was just their salary they might reach out to you by the way these are all touch points that require people to do stuff so um you know how much they're gonna how much they want to invest in that and by the way if you're talking about like amms that's just an amm front end like do they really have a coinbase compliance team um to reach out for that or are they just saying you know what there's too much risk here

um we need to just not do it I mean this is that this has partly been driven from the tornado cache with the blockchain analytics companies to say can we get more granular on alerts and and have like a Decay function because you're going to get a hit if you ever had a yeah a touch point which which might have been way before any designation point and I and I know that this the analytics companies are working on that like feverishly it's always been in demand now it's like really high demand because what you're talking about here is it's the like as I understood from the last interview sanctions actually happen as like the moment it's been sanctioned that's when it starts usually and it is not retroactive but because of the way analytics on

blockchain work it's often just scanning forever having touched including retroactively and then there potentially and we've heard about that like Banning addresses that have ever touched it that that's something that some products and some exchanges are actually using that like they're they're applying that so I'm glad to hear that they're fixing that I'm glad to hear that that would become more granular and that it would potentially start correct directly showing that it's only if after the sanction you've interacted with it yeah and I should clarify for them like you you still can go an investigator at any of those exchanges can still go into the Analytics tool and see exactly how far back it was and they can make the Judgment of like you know what

reasonably risk-based approach to this is like that was three years ago or whatever so we're just gonna let it through it's more that you can't at this stage yet automate it okay and we want to get it to a point where okay it's probably going to be not just time or hops it's probably velocity you know because there's always relayers people can put in between so I I think it would probably be like well look it was like three months or 20 hops from the designation the the complication for something like tornado cash is that that was already considered risky because of the amount of illicit activity that was going through so I think you you most likely had exchanges that they weren't blocking in a sanction sense but they were already flagging

wallets as like well wait a minute this is a this is a privacy tool that also has a bunch of illicit stuff going through we probably need to like have a sense of like what we may want to ask some questions like do we have a heightened risk profile that sort of thing so I feel like I could ask you so many more questions about how ofac works and just continue to like give theoretical idea like what would happen if but we don't really have that much time on this interview so maybe we do another one in the future um but what I want to talk about next is sort of moving over to more of your work at fincen because well first of all I want to understand how that's different and I want to understand if having

worked in it did you actually see places where instead of thinking about this privacy technology as a threat to National Security it could instead be seen as like an opportunity for better security and protection of people but yeah let's sort of move to fincen a little bit yes what's the difference how do how does it act differently is it not for Behavioral change not ostensibly I mean yes no in the sense of it's a financial Integrity Focus so they like you want people to manage risk and and counter exploitation but not yeah it's not using tools to change behavior that might be geopolitical it's a it's a more straight regulator so whereas ofac might get told by the National Security

Council in the white house um you just need to do this employ your tool in this way we we tried to resist that more at fincen and say hey we're just regular folks like doing regulation and anti-money laundering um we'd rather not get into that too much there's a couple authorities like around the section 311 of the patriarch that fincen has that can get into that a little bit but we try to keep them just the facts ma'am like we're not we're not a tool for that we're this is anti-money laundering we're going after whatever the highest risks are does fincen go after people or does it write laws or does it like what is what is it doing no that's a great question we're not they has an enforcement function but it's it's systemic AML risk so it would be

like they're like when I was there we did a big case against Capital One where it was uh it wasn't just like somebody didn't file a saw a suspicious activity report or like a person money laundered it was yeah yeah uh I can't remember which which crime family Genovese or one of the the mafia crime families was laundering like after somebody was convicted of money law wondering for a mob family was still Banking and running a check operation you know hundreds of thousands of dollars like for years or whatever um one of those things so fincen usually with a banking regulator with Department of Justice would be part of it as the financial intelligence unit and also the primary anti-money laundering Authority would say okay that's a systemic

deficiency that that stuff kept going on and we're gonna together do an investigation and and recommend changes and potentially find you money uh as a penalty for that so that's a function within it but a lot of it is really in the guidance and the rule making where they implement the statute of the bank secrecy act for anti-money laundering like in 2019 we put out extensive guidance on Virtual currency that said here's our approach to the money laundering risk it should be reasonable risk-based approach like everything else so it doesn't mean turn everything off or like Shake everybody down the moment they come into your hotel to check in like you don't need a full background check of everyone but you know reasonably uh

if it's a bag if it's a suitcase of bills or whatever like maybe ask a question so there's some reasonableness to it and the 2019 guidance said you know there is risk to this thinsen regulates based on intermediaries so you it's a person which could be either an individual or an entity that accepts and transmits money and so that's very specifically defined to be a person that's accepting and transmitting and so also in that guidance we said just to be clear software is not a person okay um and in fact anonymizing software is not a person so we specifically carved out and said like a mixer for instance if it's not centralized controlled if it's

just a smart contractor software is not something that finsen regulates so and if you do you would have to have an anti-money laundering program that's reasonable risk-based you know do customer due diligence and there's overlap there obviously because like when ofac designated blender dot IO it was a centralized custodial mixer they would have if they had U.S touch points with theoretically after register with finson and have an anti-money laundering program because they'd like your money went in to their custody and they transmitted it out does fincen ever get to change the ml laws or like change the policies change the recommendations yeah yeah actually through rulemaking okay through public rulemaking so actually it

recently happened there was uh the so Congress implemented the AML Act a couple years ago which sort of updated the bank secrecy act and then said to fincen now you do rule making to implement it and so you know so we put out rules and in fact one of them was a was a request for comment saying we think the bank secrecy act in AML should be modernized like we think it should be more based on priorities not just collect everything uh and we want to hear from the public like what's two burdensome what could be more effective like give us feedback um on on what thresholds should be that sort of thing so the I mean I'm the reason I'm asking too is is to sort of lead us towards like

in your time there you knew about zero knowledge proofs like was that a conversation and I know it's still very very early but like you know one of the big use cases that's been proposed is like CK for ID or as you had mentioned sort of like selective disclosure of some sort of information without revealing everything this could be an incredibly powerful tool to protect consumer privacy and still get information that you need to prove something would it be fincen who could like start that process once there was a really good concept and product and people felt comfortable with it yeah in fact we we did uh when I was there yes uh as a digital Innovation

officer and the deputy director and then while I was acting director um we actually we did a few things on that um in fact one of them announced during the first time I met Jill when I was doing a Fireside with her at a consensus oh cool um we did a whole initiative on privacy preserving technology uh and it's called Innovation hours where it turned out to be two days instead of a half day because we had so much overwhelming response but we said we want to encourage all these everyone to come in who's in the Privacy technology space and the AML space and find ways for everybody to be approaching Financial Integrity in a much more privacy preserving way we want to be encouraging people to like prevent exploitation and do this in a more

privacy preserving way and and and also I also brought in um specifically a digital identity counselor so it was someone she had she had worked before with India and setting up their digital identity the system and it was like come on in let's carve this out and just focus on digital identity um we also had a someone who specifically was focused on Virtual currency put them together with other Innovation folks to focus on some of the zero knowledge and privacy preserving work and so did a couple days with just encouraging people to come in we think we specifically called out zero knowledge proofs homomorphic encryption like there have to be ways to for instance just prove someone's not on the ofac list yeah you don't you don't need

to know what your name is at all in fact it really doesn't matter we just need to know that you're not on the ofac list and people can move on and some of this came out of um working in in covid during the economic relief programs the treasury needed to get money economic relief to people really really fast and so part of it was like from fincen's perspective working with the folks doing that saying you know on the one hand they they said we know this is going to get looked at later if it all turns out to go to fraud we're going to be in trouble we don't want that but we also need to get it out really fast and so what's the line of like AML that we need to have and identities and of course there was like hundreds of millions of fraud

um partly because it needed to go out so fast and also it's it and you had people that couldn't get it because their Bank was not especially Community Banks were not connected into the FED system directly to get the money and so people had to change Banks but you had to start over with your kyc and it was like well why isn't this portable kyc why do you have to redo that wow we worked on ways to try to lower the lower the time to say for the new Banks hey if someone's been at one a bank for a certain amount of time can you sort of wave them in while while you do it and then some of the banks said I'm not sure I'm comfortable with that this is where you need something else so you can tell there's like it's systems of yesterday

trying to deal with like the speed of now and it's like kind of not working there's like missing it sounds like there's like really important pieces missing and it's a use case that's concrete like it it's it's always theoretical until you have like a crisis like that and that was a concrete crisis to say we could not get Aid to the people that needed it because they didn't have portable identities kyc and by the way they didn't need to give their social security number to 30 new people um like they just needed a zero knowledge like yes you've been verified by JP Morgan proof yeah you're fine like let's move on and so that was actually it was a place where we like I had theoretically been talking about it for

a while and and our folks had too but it was one where you could go to Maine Treasury and say we really have to do this like uh like this is why concretely and and working with other agencies in the in the identity space and now there's a lot of work in the US with like actually the driver's license folks to to work on digital identity yeah the DMV um because they're going to be The Cutting Edge you'll see like they never were but maybe they will be huh well ironically they they are how are they yes like they are actually it's turning out like uh there were some states doing a pilot with apple actually oh cool because at the end of the day nobody wants to be the one that's like this is really Anna like it's all great to have your nft or whatever but someone has to

be on the hook to say the the nft or the zero knowledge certificate that you got was legit and it's hard to do that and and actually the DMV at this point is the place where somebody really checks you out to make sure it's really you in real life so so there's some Pilots actually happening in the US right now um and it's it's like between Apple and some states that are that will you will get a certificate um except nice but also not nice that it's a centralized company that's kind of a bummer yes yeah yeah yeah but we gotta start we gotta start something digital okay yes yay we'll get there we'll get to decentralized credential to verify and I should say like part of the interest from a fincen perspective too was one was preventing victims

um by not having personal information everywhere and and in covet it wasn't just that people couldn't get Aid it was also that people and criminals all went online more and the amount of like identity theft synthetic identity and identity fraud credential stuffing that was going on like cyber crime went through the roof and part of that is because like your credentials are not safe online um I I feel like there are so many banks that are still not even doing two-factor authentication like let alone whatever else and you had criminals that like they were they weren't going to go out they were doing more online so so like the need was sort of through the roof on both sides of it and so and part of what we've pushed especially in the virtual

currency space where you have a public Ledger anyway was like there's so much synthetic identities and identity fraud going on anyway let's move away from this identity base and go to activity based and like what are other indicators of bad activity that we can use Beyond just like a fake ID totally at a dinner yesterday uh with some of the Aztec folks I actually had a chat about this idea of like the ID and having that live under a zkp but also needing for that to really work you need to also have an ability to kind of correct potentially like misinformation associated with your identity under that like under the cryptography because the

worst thing and there is this sort of like scary vision of like you have this identity it's cryptographic it can never be changed and it follows you forever and maybe you did make a mistake or maybe you were like maybe you didn't make a mistake but someone assumed you did and somehow that's like on your record forever buried in cryptography unable to be changed immutable like that's scary too yeah yeah for sure yeah you need a jury or some sort of group that could like correct it a multi-sig I'm sure that was definitely a proposal at the dinner table but um Michael we don't have very much time left I want you to maybe just share a little bit more about what you're doing today and uh yeah and then we'll sign off yeah so what is

espresso systems is building and the reason I'm there from out of government working on counter exploitation is is exactly that where it's empowering people to use zero knowledge to have configurable privacy to make things more private so you're not exploited to begin with but have the ability to selectively disclose or verify in a zero knowledge way that there is some sort of verifiability behind this and and manage risk and I think that's does dovetail with the work that governments should be doing and I think many are to prevent exploitation on the front end cool Michael thanks so much for coming on thanks Anna so that wraps up our two interviews I want to say a big thank you to the ZK podcast team Henrik Tanya and Rachel and to our listeners thanks for

listening