Cryptocurrency in the Age of Mass Surveillance

Transcript

great okay so you're ready for me to uh get started great terrific awesome well thank you so much for having me i'm absolutely delighted to be here uh virtually albeit uh thanks for allowing me to be here remotely um and i'm i'm really excited to talk about cryptocurrency uh in the age of mass surveillance so i want to start with a photo that i really think underscores the ideas here this is a picture from the hong kong protests and it shows the long lines at the subway stations that there were when there were pro-democracy protesters and they're waiting to purchase tickets

with cash because they don't want their electronic purchases to place them at the scene of the protest so for me this really underscores the importance of the ability to transact anonymously for me this underscores that a cashless society is a surveillance society um and for me this underscores why cryptocurrency in particular is important uh for me cryptocurrency is important for civil liberties precisely because it imports the anonymity of cash into the online world and this is in my view

a feature and not a bug there are a lot of people who disagree with me and you know i think one could say reasonable minds can differ here but i think one of the big conception misconceptions that i see in the debate around financial transactions and privacy is this idea that anonymity is bad and that tools that enhance privacy uh enable crime privacy and anonymity are not bad or illegal in the united states they are in my view essential for civil liberties uh they're essential for free expression and they're essential for the right of free association and this

is especially true for financial transactions financial records contain a trove of sensitive information about people's personal lives their beliefs and their affiliations and uh the refrain that cryptocurrency facilitates crime is is simply wrong um the idea that a technology could be used to violate the law does not mean that there is something wrong with the technology notably criminals have long used cash to commit crimes but you don't necessarily hear us congress members asking for a ban on cash uh as a result of that and we don't

blame ford when one of its cars is used as a getaway vehicle in a bank robbery um so i wanted to start there just by by setting the stage for how i really like to think about uh anonymity and the importance of anonymity for civil liberties i want to talk for a moment about the way that financial surveillance works right now in the united states um i'm a u.s lawyer so a lot of my views are particularly localized to the united states and so i'm going to be talking specifically about u.s law today just as a disclaimer um but

i want to take a moment to talk a little bit about the current surveillance measures in the u.s that the government imposes in the traditional banking world um and how it conflicts not only with in my view international human rights law but also how it seems to conflict with america's own bill of rights so the u.s constitution requires that law enforcement obtain a warrant supported by probable cause before conducting a search for seizure so why is it that in the traditional financial system in the united states law enforcement can actually engage in mass surveillance of bank customers without a warrant um this would seem in

my view to be uh contrary to the united states constitution the answer here is a thing called the third party doctrine so this is the idea that people do not have a reasonable expectation of privacy in the data that they share with a third party like a bank and in 1976 the u.s supreme court held in a case called the usv miller that the bank secrecy act uh didn't violate the u.s constitution because of the third-party doctrine that bank secrecy act is the same act that is being used still today to enable law enforcement to obtain a massive amount of financial records directly

from banks um and for banks to have to turn those over by default to the us government uh even without a warrant um but you know even in the 1970s the supreme court justice who authored that miller opinion wrote in another case that financial transactions can reveal much about a person's activities associations and beliefs and at some point government intrusion upon these areas would implicate legitimate expectations of privacy so since miller that was in 19 in the 1970s the government has greatly expanded the bank secrecies act reach so in the 1976 the government was looking at what the bank secrecy act um was doing

then at that point and what law enforcement what information law enforcement was obtaining at that point um and i i personally believe that if the supreme court looked at this again many years later um that they would actually find that the way that the bank secrecy act is being applied right now which is to say having massive amounts of customer records that are turned over to law enforcement without a warrant by default and mass would actually be found to be unconstitutional um and the reason i think that is is twofold one is just that the bank secrecy act has has greatly expanded and the second is that the amount of information that one can glean from financial records

has just expanded exponentially since the 1970s um you know the amount of information that someone could get from someone's bank records in the 1970s uh very very little whereas today it can really paint a 360 degree view of someone's life of their political beliefs of where they are physically located and who they associate with and these are the types of things that law enforcement is supposed to go get a warrant before they are able to uh before they are able to actually have that kind of information turned over from them this is not something that in the united states law enforcement is supposed to be able to get uh for all citizens so um unfortunately of course this has not

this issue has not reached the us supreme court so what we actually have right now is um other court cases that are looking specifically at this 1976 decision in usv miller and finding that it's okay uh to not only for for the bank secrecy act as it's applied in the traditional banking system to have those records turned over to law enforcement by default but that it's also okay to do that in the context of cryptocurrency um for me i find that really problematic um and so um for me i wanted to talk a little bit about

a case from uh last year that i i found very troubling uh so this was the groutkowski case um so this um this basically was a case where the u.s government had gone to a particular cryptocurrency exchange and without getting a warrant had asked them to send over information about a particular individual mr grotkowski and this was in connection with a criminal investigation they were doing but they didn't go through the trouble of going to get a warrant because they didn't have to all they had to do was ask this particular cryptocurrency exchange hey uh could you please hand over this information

and uh they went ahead and handed over the information um and so the mr gratkowski challenged this in court um and he said you know look they they that's it's great that they have got that information but they got that through they got that through a legal means they should have actually had to go and get that a warrant in order to get those transaction records and the court here held that the defendant actually didn't have a reasonable expectation of privacy uh in his cryptocurrency transaction records and so um the police didn't need to get a warrant uh to see them um and so that applied not only to the

transaction records but also the identity that was associated with this particular person's cryptocurrency uh exchange account um and for me that isn't this decision um uh really isn't just important for individual criminal cases right this was a particular criminal case this was um mr gutkowski and certainly if law enforcement had went and gotten a warrant they ultimately would have been able to go and and get that information they just decided they didn't want to and so here's why this case matters the case matters because it means that the government because it doesn't have to get a warrant can just go ahead and partner with private companies to effectively

implement mass surveillance programs that the government can partner with uh with with cryptocurrency exchanges in addition to the way that they've partnered with banks and other traditional financial institutions and have engaged in um mass surveillance so they can do that with cryptocurrency exchanges as well because they don't need to go get individual warrants in order to uh get this type of information about individuals and this sounds maybe a little paranoid but we absolutely know that these types of partnerships happen um esf where i serve as special counsel um has actually sued the nsa in the united states for warrant warrantless uh mass surveillance of americans

that was in cooperation with att um where they were uh going and scraping a ton of att's records um and and this again was enabled because they didn't need to go get a warrant for individual uh for individual transaction records so now we have uh now here we have um the a court saying um uh now we here we have a court uh saying that this this can happen in the cryptocurrency context um so this was something i found very concerning last year and and again i truly believe that if this case if if these types of cases not just in the cryptocurrency context but also in the general financial context

were to make it back up to the united states supreme court that it may actually turn out that the supreme court today says you know what actually um this is not what we had in mind in the 1970s when we said uh okay you can you can get some information without a warrant that that now today with the amount of information available that this is something um that actually would require a warrant um but unfortunately we we don't currently have a path to getting that decided um but um very unfortunate about this this particular case the groutkowski decision last year um i want to walk through some of the other updates in the cryptocurrency and privacy space

um and how i'm thinking about them and um for me there's a big theme here which is that over the course of the last uh over the course of the last couple of years but especially increasingly in the last 12 to 18 months there has been a huge push from governments around the world but especially from the united states government to really take the mass surveillance that we're so used to in the traditional banking system and extend it to cryptocurrency um i find this really concerning uh and very problematic for civil liberties so i'm gonna walk you through some of the things that have been

been happening recently um and and how i'm thinking about them so um in october uh there was this uh department of justice uh in the united states again cryptocurrency enforcement framework um and uh the report uh in my view had a lot of very sort of shocking positions um very very strong positions that the department of justice was taking uh about cryptocurrency um and at the time you know we hadn't yet seen some of the later proposals and so i think this was one of the sort of early warning shots in this space that what was going on

uh uh was was sort of the beginning of a trend in uh increasingly uh moving mass surveillance to the world of cryptocurrency so i'll give you some examples of what the department of justice said in this cryptocurrency enforcement framework so first of all they've made up a term called um aec's anonymity enhanced cryptocurrencies um and and by this they mean they specifically mentioned monero and zcash um and they said that the department of justice considers the use of aecs to be a high-risk activity that is indicative of possible criminal conduct and that companies that choose to offer

aec products have increased risk of money laundering etc um they also said that websites or companies that offer mixing or tumbling services are engaged in money transmission and therefore have to actually register um with the government um and must collect customer identification information uh else the operators may be criminally liable for money laundering um and so again this to me was a a a pretty uh pretty surprising and um very very strong stance um and this is something um that we've

we've seen before um saying that this is indicative of possible criminal conduct um this is something these are the types of arguments that we constantly see law enforcement agencies using when they're attacking encryption um you know i started off the talk by talking a little bit about um this misconception that anonymity is bad and anonymity enables crime and that's exactly what law enforcement is saying here but in reality um in my view uh anonymity actually enables and enhances civil liberties and so for the doj to take these particular positions

in my view was very very problematic another thing they said uh in the doj crypto enforcement framework in october um i found problematic for other reasons so they said that peer-to-peer exchangers are considered money services businesses and are subject to record-keeping and reporting requirements um and effectively that failing to register um you know when you're even when you're doing uh p2p exchanges um is something that uh uh is illegal and that

the idea that p2p exchanges actually need to be registering with the us government and need to engage in record-keeping and reporting requirements which is to say they need to be keeping track of p2p you know even in p2p transactions they need to be keeping track of effectively who is uh who who they are who who their customers are who the people using um these these p2p transactions are and um and what those transactions are and then reporting those out to the government i found this extremely problematic specifically um because it you know they seem to acknowledge

that peer-to-peer ex like the idea behind peer-to-peer is that you're allowing users to trade directly with one another but nonetheless they somehow think that there's something some intermediary that's supposed to be registering with the government and is supposed to be um complying with record-keeping requirements uh and for me that's really really problematic because you get to this question of okay well who do they think is supposed to be doing that is it the people who's writing the code um you know is it uh is it the users themselves like who are the people exactly who are going to be subject to these criminal penalties um and so this is one of the areas where i see a couple of different areas

intersecting um we have these these the the governments increasingly pushing for these record-keeping requirements um and we have the government also um uh effectively uh trying to impose this on peer-to-peer um and and that for me um is is a real problem and uh again i'm a u.s lawyer so i'm thinking about things through the lens of the united states um but this reminded me quite a lot of a big problem that uh we saw where um the sec basically uh charged the founder of a

crypto decentralized exchange ether delta um with operating an unregistered securities exchange um and the issue here uh the eff other folks at eff and i took a look at the the sec's statements that it made in connection with bringing these charges um and the issue was that they were talking about a particular decentralized technology and so when they were trying to pin down okay well who is it that's going to actually be on the hook for this um they said that

the the issue here is that uh ether delta's founder had written and deployed co the ether delta smart contract and that he should have known that that would contribute to violations of of the sec's uh regulations and he all the sec also wrote that a person who merely provides an algorithm that was their language provides an algorithm could be providing a trading facility and would need to have a license but before deploying that code um at eff we took issue with that um that you know there there are um uh uh again i'm talking specifically uh about the united

about what what's going on in the united states um but uh in the united states we found that that type of language uh raises some pretty serious first amendment questions um you know the idea that someone could be liable here um specifically for providing an algorithm um violates one of the sort of basic uh and uh sort of tenants of first amendment law in this area which is that code is speech um and so uh this sort of goes back to the bernstein case which is actually one of

eff's early cases where the court found that forcing cryptographic researchers to obtain a license before publishing code was a violation of the first amendment and the u.s requiring someone to get a license before speaking is a is a called a prior restraint on speech and prior restraints are justified only in unusual and extreme circumstances so if you restrict the ability to merely write and publish code you can't that doesn't meet that level of scrutiny for prior restraints on speech so um uh several other others at the eff uh rainy reichman aaron mackey and i um wrote this long letter to the sec um

basically saying that um requiring coders to obtain a license would be um a violation of the first amendment and that the language they were using here um was was potentially very problematic um but at the time you know we were talking about just a few sentences in this order but it was really important for us because we realized that this could really be a glimpse into the future of regulators trying to put their finger on decentralized exchanges um and indeed fast forward uh you know this all happened a couple years ago but fast forward a couple of years

to the doj crypto enforcement framework and suddenly we sort of have reached this place where the department of justice is taking positions that are particularly problematic um for uh for uh uh for privacy uh and civil liberties um so uh i wanted to that give that sort of back story as to the things that i think are important um around this issue of who's actually writing the code because of course the question of liability um is a huge one um but i also wanted to talk a little bit about um things that are are sort of where it doesn't

necessarily matter whether there's liability or not um because one of the things that we've been seeing recently um is that there is a growing list of cryptocurrency exchanges um that include shapeshift um and light bit and bit tracks um that we have seen de-listing privacy coins like zcash and monero um and they're often citing pretty vague concerns about regulatory and compliance issues uh and so here we're seeing something really interesting which is you know even if there aren't particular even if people aren't in particular uh uh uh liable for for a particular thing um or even if there aren't laws on the books that

anyone is particularly uh violating uh the government is appears to be using soft power and or um spreading uh sort of fear uncertainty and doubt such that it actually is making it uh very difficult for exchanges to operate using anonymity enhanced cryptocurrencies um so we we saw the doj enforcement framework language where they made up this whole uh this whole um three-letter acronym aec's to describe monero and zcash and other anonymity-enhanced cryptocurrencies um and suddenly it's very difficult for crypto exchanges um to be listing um those privacy coins

what's going on behind the scenes uh i think there's a select group of people who knows uh what's going on behind the scenes and um i hope one day we find out um but in the interim i'm i'm pretty concerned about this this trend of crypto exchanges uh dropping privacy coins um so another big another big big uh sort of part piece of the story um on on the us government in particular pushing forward with trying to extend the traditional banking systems mass surveillance to cryptocurrency um was around uh christmas so it was last december uh and it was

right the friday before christmas um and this is of course right before the turnover uh from the trump administration to the uh to the next administration um which was going to be turning over a couple weeks later uh the treasury's financial crimes enforcement network fincen drops the proposed rulemaking and this rule making would require um certain businesses like exchanges to keep records of cryptocurrency transactions over three thousand dollars uh and to report those cryptocurrency transact any cryptocurrency transactions over ten thousand dollars uh

to the government so essentially this expands the rules of the bank secrecy act to crypto exchanges um but um so they so they dropped this and and you know these types of proposal makings are relatively common but because it was the end of the administration they were hoping to shove this through and so they actually gave the entire industry only two weeks to comment and this was the friday before christmas so everyone's about to go out on vacation and suddenly we have two weeks to comment on this this massive proposed rule so um i think the industry really stepped up here um eff uh submitted comments but many many

others um submitted submitted comments as well and in eff comments we were specifically um highlighting a couple of different points um that we wanted to get through to fincen in trying to stop them from moving forward uh in two weeks with this this sort of massive change um you know one one place where um it's a little tricky even within the cryptocurrency community is um there are a lot of people who including some some very well-known and well-respected um cryptocurrency policy shops that basically take the position look if you're already regulating uh you know

the traditional banking in a particular way go ahead and extend that to cryptocurrency um so a lot of the comments that were submitted to fincen took this position of like you know you can you can implement some you know expanded surveillance of cryptocurrency as long as it's just what already exists in the financial system uh for us for effs um we took a much stronger position so our position was first of all um actually the entire the entirety of the way that this is applied to other assets not just cryptocurrency the way that the bank secrecy act is applied is unconstitutional period end stop

um so you certainly shouldn't apply it to cryptocurrency but frankly you shouldn't be doing this with traditional assets anyway um but second we made this argument that cryptocurrency data is different than regular data and here's why so you know purportedly what they're trying to say is well you know you only have to keep transaction records over three thousand dollars and you only have to automatically report cryptocurrency transactions over ten thousand dollars to the government but here's the problem as we all know um all this transaction data is publicly and permanently recorded on a public blockchain in in the case of for example

bitcoin so this means that if you end up learning the identity of a particular user associated with a particular address you're gleaning and you're able to glean information about them that goes way beyond just the transactions that are over ten thousand dollars or over three thousand dollars um and so you as a result of that it really isn't possible in the cryptocurrency context to limit it the way that they are claiming to limit it to transactions over a particular uh amount um and so that was one of the arguments that we thought it was really important uh to we really thought it was really important to make um and that you know many folks in the um cryptocurrency

legal community and myself included um you know spent their holidays writing um and they're sort of was a um uh happy ending-ish to this and i think there was a pretty big win here which was um they ended up vincent ended up getting despite this two-week window over the holidays so many they got 4 000 comments um uh uh i think just in the first uh week and a half and and they ended up with uh seven i think 7 500 by the end of the two weeks and uh at that point i think it was i think they sort of realized they couldn't say in good faith that

they had actually you know looked through and had responded to all of this and could really get it through in those two weeks and so as a result um they had to postpone it push it out to the new administration they didn't end up um implementing it and they have extended the the deadline they extended the deadline out initially to march and then they pushed it out again um to the fall so at this point we don't know ultimately what's going to happen but we did have a small win in that um this particular uh thing did not get um pushed through um as a sort of an additional piece um we saw um faddis which is the us

the the financial action task force um issue new draft guidance um that would also um i think be part of this larger trend in that it would dramatically expand the definition of financial intermediaries to capture a host of players in the dfi ecosystem and this includes expanding the definition of virtual asset service provider or um vasp um and uh there's all sorts of things to say about this particular fatif guidance and and the many many reasons that this is uh highly problematic but i wanted to just note that one of those is in fact um this particular that this is in fact part of the

particular trend around privacy uh issues um in the cryptocurrency space so um i i wanted to also make sure that we talked a little bit not just about financial surveillance here but also about uh financial censorship um so in this space um one of the things that is a a huge problem that is in my view really not sufficiently talked about um is the extent to which payment intermediaries in the united states really serve as financial sensors um so there are um many many different

types of folks who are having their regularly having their accounts financial accounts suspended making it absolutely impossible for them to take to make monetary transactions online and so that includes for example wikileaks which is one example but it also includes things like adult booksellers or um adult social networks or other whistleblowers um and so there are all these there are all these examples of payment processors cutting off services to entities that are perfectly legal but that that they find unsavory um you know so imagine you're running an adult bookstore during coven

and visa and mastercard decide they aren't going to process payments to you so how do you survive right how do you survive in that instant um another big group that is often targeted here um is sex workers um but again it's not just things that are um allegedly illegal it's also things that are that are merely unsavory um and so i think one of the things that's so important about cryptocurrency is its ability its inherent resistance to financial censorship the fact that it makes it harder for institutions to deny you service based on who you are just because they find you

um potentially unsavory um so in january um the office of the comptroller of the currency uh finding finalized a um particular rule called fair access to financial service services now this was um this was by the then comptroller of the currency brian brooks um brian was the former uh uh general counsel of coinbase and he is now the ceo of binance us um and a huge friend to the cryptocurrency space um brian was in as the comptroller of the currency of the united states for only a few short months but i think he did more

in those few short months for cryptocurrency um than basically any other regulator has done in in years and years in office so um really phenomenal regulator and um one of the things that i thought was really really an exciting development on the other side was that brian proposed this fair access to financial financial services rule and this would have basically prohibited um banks from refusing to serve customers that they find politically or morally unsavory and this is important because um banks for many years have refused to serve entire industries on the basis of political disagreement um and many other financial intermediaries as we've discussed

have engaged in this mass financial censorship for projects that they think are controversial even when they're engaged in protected speech and i think for folks in the crypto space we're all too familiar with these problems right um so it's often uh the case that individuals working at legal us cryptocurrency businesses are denied personal banking services because of their employment and this is a huge barrier for cryptocurrency entrepreneurs and in my view uh whose uh time and energy would be much better spent innovating rather than trying to figure out how to get a bank account um so under this new occ rule um banks would still be able to refuse

to serve certain customers but like only on an individual basis um and that would be based on a customer by customer risk assessment rather than refusing to serve an entire industry such as the cryptocurrency industry but unfortunately um like in one of the the uh strangest turns i've seen in the uh this space the rule got passed but got went through um but mysteriously just didn't make it on to the federal register um and so unfortunately uh the rule was sort of pocket vetoed through some sort of weird back end thing that um no one really has

any um idea what happened so um it was a was this positive step forward but unfortunately appears to have been mysteriously killed so i know we have um just a few minutes left but i i just want to hit a few final points and really um just underscore this last point which is that a cashless society is a surveillance society and the most important thing about cryptocurrencies uh is their ability to import the anonymity of cash into the law online world um you know i think we need the privacy and anonymity of

cryptocurrencies in order to be able to buy and sell and trade freely in a digital economy um and i think when we de-list these cryptocurrencies or otherwise subject them to undo regulatory control and pressure and when we impose over broad measures to dismantle anonymous crypto transactions we aren't uh helping to take financial tools out of the hands of criminal actors but instead what we're doing is we're depriving all internet users of the best means to protect their anonymity and privacy uh when making transactions online um so um with that um i will wrap up

thank you all so much for for your time and and uh and being here in person uh and uh thanks again so much for having me uh so the short answer is no um so we

have certain intergovernmental agencies that um like for example that you'll where you'll see that there are um um so for i think the the one one example of where you see i didn't cover this in the presentation because there was limited time um but there's a thing called the travel rule um and and the travel rule is something that is uh being implemented across a variety of uh of countries um and um so i think you see certain um things that are implemented as like compliance best practices um similar to similar to the the travel rule but i think the short answer is

not really sure um yeah so how does this apply to fultz outside the us so you know i again because of limited time i didn't cover this but another thing that i thought was really i mean i have to tell you when i saw the doj

crypto enforcement framework um i was pretty shocked um and one of the things that was really shocking is they took some really aggressive positions about where their where their jurisdiction lies and and sort of in what you know um and they basically took the position look uh anything that could affect the united states from like for example a terrorism perspective falls within our jurisdiction so when you're talking about something like cryptocurrency which could lead to a you know some sort of terrorist threat

we basically have jurisdiction everywhere and i'm not even really exaggerating that's effectively what they said um you're like you can go and and look at the language and it's like you know pretty pretty shocking to see them taking that position um but i mean you know relatively um shortly thereafter um you know you've definitely seen uh uh uh different entities uh that for example in um uh uh the uh oh god how do you say it seychelles is that how you say it uh you see a bunch of you see you've seen those types of um uh you've

seen the us go into those types of places and and actually i start there um i start jurisdiction over entities that are operating uh in seychelles and not in in the united states under that particular theory thanks so much you