Peter Van Valkenburgh: Coin Center – The Sanction on Tornado Cash #458

Transcript

welcome to epicenter the show which talks about the technologies projects and people driving decentralization and the blockchain revolution i'm friedrich ants and i'm speaking with peter van berkenberg again who is the director of the director of research at coin center and uh we're here to talk with pete uh peter i'm here to talk with peter about the tornado cash situation um but before i do that let me tell you about our sponsor this week our sponsor is telly ho and teddy ho is redefining the wallet as a public good you can think of it like a community-owned alternative to metamask it offers a much smoother user experience compared to many other wallets and has an impressive user interface so

basically you can see all your account balances at once and swap between assets from within the wallet at a much lower price the wallet also offers one of the best ledger integrations and full ens and uns domain support and it's recently added its first sidechain polygon and on teddy hold polygon support is now built um in automatically and ready to use and with teddy ho you can enter the metaverse with a web3 wallet that's fully community owned and operated it's also dao so the commitment to community ownership um stretches far beyond the wallet in january they became the first ones of ether sjs an open source javascript

library helping developers connect to ethereum and they recently announced a pledge to commit two and a half percent of their token total token supply to a git coin architect so head to tele.cache download to redefine your web3 wallet experience and i would also like to announce that we are hiring we are looking for community manager to help grow the audience um of epicenter and take us to the next level and if you're passionate about crypto and creating great content um reach out to us um there are uh details on um the job description in the show notes um and please also share this with anyone who you think might be a good fit for this position okay peter

it is so good to have you on uh you have been on many times before to talk about regulatory matters in the us and usually it's bad news when i'm here right usually it is bad news we still like having you on and um today we're here to talk about the tornado cash situation so can you give us a short rundown of what happened yeah so i guess in in in very brief there is an office within the united states department of treasury called ofac the office of foreign asset controls and the office of foreign asset controls is the division of treasury that enforces

nset's policy for u.s sanctions and sanctions is as many of your listeners probably already know sort of probably the chief policy tool foreign policy tool that the us uses these days because mercifully we don't go to war very often but when we have um states that we identify as enemy states or we have persons that we identify as involved in terrorism or other horrible activities we use the sanctions to cut them off from the global economy to the extent that the u.s can get away with that because we have most of the banks and a lot of the systems for moving money and ofac is the office that does it so ofac um they get their power from this

statute that was passed by congress um in the middle of the 20th century called the international emergency economic powers act that statute came from originally an older law called the trading with the enemy act so you can get us that one actually has more of a flavor of what it actually is you know uh the more modern language is more polite but it it also maybe hides the ball a little and under that statute uh the president or anyone that they delegate which in this case would be the secretary of treasury and the director of ofac can um identify uh emergencies uh in this case there's a cyber emergency that was declared at the end of the obama administration

because of north korean hackers and ransomware and other things like the lazarus group and so under that emergency the office can then take action to investigate to block to prohibit americans from interacting with from using transferring um importing exporting the property of a foreign person or or group of persons and so that's a very sweeping power you can find that at 50 usc 1700 and where have we seen that power used in the past we've seen that power used in the past to designate persons like the lazarus group which was the hacker collective in north korea

um as sanctioned persons which means as an american you're no longer allowed to transact with those persons last may we saw them bring sanctions against blender.io which was a bitcoin mixer it was a custodial bitcoin mixer where you sent bitcoin to certain addresses a few people probably russian foreign nationals um were sort of loosely organizing that controlling the funds sent to those addresses mixing them and sending them back to you so blender.io and its aliases like its website and its bitcoin addresses were added to the ofac list and then just last a week or two weeks ago now i suppose the office of foreign asset controls announced that they were

sanctioning and this is their press release another mixer like blender dot io and that other mixer turns out to be tornado cache and this has led to i think maybe we would think on this podcaster a lot of people listen to this podcast somewhat predictable confusion and outrage and fear because while we didn't particularly mind uh might have even agreed with the notion of sanctioning the lazarus group or sanctioning some bitcoin addresses that are controlled by people who are actually actively mixing people's funds on their behalf tornado cash is of course a different kind of mixer it's non-custodial um at least 21 of the sanctioned addresses so there's this list the sdn

list where where the names lazarus group blender dot io tornado cache all show up and this list usually also includes aliases or identifiers of the sanctioned person's property and so in the tornado cash example at least 21 of the ethereum addresses added to that list and we've had several people look at this to confirm are credibly autonomous or immutable contracts running on the ethereum blockchain with no ability of the original authors of those contracts to update them change them control the funds moving through them they're really just robots on the internet and so this raises all kinds of questions because as an american you're not

allowed to interact with anything on the sdn list typically that's not too hard because it's like oh i guess i can't buy this house in iran anymore that's the property of a foreign national but if the thing on the ofac list is suddenly not a house in iran or a bank account in panama it's just this public tool that's widely available to anyone who syncs up with the ethereum network it creates all kinds of ripple effects as to like i guess i can't interact with this i can't touch this i can't what if my money's locked in the contract because i was using it for my own personal privacy and it also raises very practical questions of how the law is supposed to work which we can get into coin center's interest here um is i think primarily to do with whether

ofac has overstepped its statutory um powers because the statutory powers say you're allowed to block property in which a foreign country or national thereof has an interest but does a foreign country or national have an interest in those 21 smart contracts that literally no one has control over i don't think they do by virtue of the very real and provable fact that those persons or people can't change that contract and so we would argue and we may end up arguing in court that this is beyond the statutory powers that congress granted ofac and therefore it's not a permissible action and then the developers of the original contract are probably going to end up

they may end up in court um you know they may say look all we did was write software um yes we are kind of like a loose group of people that contribute to an open source software project that ended up creating these contracts on the on the ethereum blockchain but they are not our continued property we had no intent to allow north korea to use this tool to to to um launder money and we're researchers and software developers and so we should deserve some protection under free speech standards uh at least in the us maybe in europe as well and so this is all unfolding in real time and you have lots of questions i know uh that we can use to to drill deeper into it yes i have lots of questions so you know

you know me so well maybe let's start at the tail end so let's say i am a very unfortunate individual and i end up on the ofac list so what exactly does that do to me so basically you said basically by the powers that kind of the united states government is somehow imbued with because you know it has so much of the economy under its control and the banking system and so on um and i get cut cut off from from the international economy what does that actually look like so i mean to be very clear the powers that are described in aipa the international emergency economic powers act

are powers to prevent americans from transacting with you if you're on the sdn list and so you know if you think of that in a minimized way you think well i just can't deal with america anymore but of course america is where many if not the majority of large technology and and finance companies are based whether it's google whether it's jp morgan whether it's wells fargo you know and all of these companies together form huge swaths of critical infrastructure around the world whether it's for moving packets of data or moving money um that's changing that's changing for a couple reasons i think europe and

certainly china and russia don't like having to rely on these intermediaries because they're realizing that that means they can be fully cut off if say somebody is sanctioned in those countries and it's also changing because of folks like like your your listeners who are building um decentralized tools with the goal of replacing intermediaries with software so that we can have a more neutral and fair world but at least in the meantime obviously if no american or american corporation is allowed to interact with you or your property whether it's by transacting with your property or materially supporting you or you know selling you dns registry services or any number of other things you are going to have a hard time

doing whatever it is you wanted to do and you know to be very honest that is in some cases a good and effective tool for seeing the change that we want to see in the world as americans it's a little bit aggressive um it's less aggressive than going to war with the country and so yeah i mean it it would be wrong not to address the elephant in the room which is that vladimir putin invaded ukraine just recently has brought the world to the brink of global conflict uh closer that it's been in you know probably a century or half a century and the main tool that we're using to to fight that aside from the ukrainians who are fighting it directly is sanctions

i'd point out that there was actually a really provocative and convincing thread that somebody tweeted recently that i was looking at and i retweeted about all the ways the russian oligarchs are getting around sanctions because they can kind of have backroom deals with powerful bankers around the world and say like oh you don't really want to sanction me you want to sanction vladimir putin which completely takes all the wind out of the power of the sanctions sales um and is also unsurprising giving how corrupt we know the international banking sector actually is and that's where most money gets laundered but you know this is this is the way we do foreign policy this is how things have evolved in the latter half of the 20th century in the 21st century and so you know this is the power and we can have a debate about whether that

power is um justified whether it's kind of the u.s being a bully whether we want the u.s to be a bully in some cases and don't want them to be a bully in other cases right and then what happens ultimately when something ends up on the sdn list that maybe isn't properly the target of sanctions like isn't actually actually an al-qaeda terrorist or a north korean hacker but is a tool that's used by a bunch of innocent persons just trying to defend their own privacy online so seeing that i for instance am not an american and i mean i i have a bank of america a bank account so obviously that would be gone but seeing that i also bank with german banks

would they also close my accounts i mean is it a transitive ban so basically if they interact with me uh then american banks disallowed to interact with my german banks so this gets into something that is also fundamental about the way we've done financial surveillance and control in the last half century we don't have very clear standards and rules we have what is called euphemistically a risk-based approach to anti-money laundering and counter financing of terrorism policy and what that means is if you're a bank say a u.s bank or an

international bank with many contacts in the u.s because you want to engage in correspondent banking you want to connect to all the u.s people so you on behalf of your european customers or things like that then you are obligated under u.s laws and maybe under the laws of your own country which happened to look a lot like u.s laws because of an organization called the financial action task force which was started out of the oecd still meets in paris every year tries to make sure that all the member nations and there's no treaty here there just happens to be sort of voluntarily sent delegates from every member state around the country around the world tries to make sure that all the member nations have the same anti-money laundering standards and all of this

comes down to a what what i said earlier is a bit of a euphemism a risk-based approach and so i can't give you a firm answer that um you know the book of any money laundering compliance here in the u.s says a transaction that's two hops away from an ofac sanctioned ethereum address is okay but one hop away is not okay it's a risk-based approach and so every institution is going to look at their risk and think oh do i want to touch that or not and i don't think it's surprising to say that bankers are inherently conservative people uh who are fairly risk-averse except when it comes to maybe leveraging customer assets to make big profits certainly i mean you know they're

certainly risk-averse when it comes to their regulators because their regulators can shut them down and so that you end up with this default regime of extreme caution yeah there's no black letter rule that says i'm not allowed to touch a transaction that's now eight hops away from an ofx sanctioned address but because it's eight hops away i still suspect it and you know if i'm worried about my bank examiners coming into our back room and looking through our books and asking questions i'll just not do it especially if it's not profitable to me and you know especially in crypto winter maybe it's not profitable to me so the collateral consequences are pretty severe and it's all because of this sort of you know there's a fog

there's a fog of fear and uncertainty there's no clear standard and therefore the standard that that it becomes the default rule is just extreme risk aversion because the penalties are so severe i think one thing i haven't explained on this podcast yet which i probably should have led with is that a violation of ofac in other words an american transacting or or someone subject to american jurisdiction a u.s person a violation by transacting with a sanctioned entity if it's willful uh is a 1.5 million dollar fine and 30 years in jail those are maximums but they're you know they're the prosecutors perfectly within their rights to seek the maximum

and just to underscore how grave this is now there's a fellow in new york state i believe a professor at one of the new york universities who use tornado cash to donate to planned parenthood to support abortion rights here in the u.s and then tweeted about it he outed himself he's like yeah i violated the law and so you know you couldn't ask for a more open shut case of a willful violation of ofac um and i i i don't know i don't know the guy personally so he seems like an okay guy on twitter i would not want him to get slapped with a 1.5 million dollar fine and 30 years in jail okay that that that is pretty steep um

so surely there's a good process of determining who actually gets on this list right i mean it's a rather slab dash list of different different entities so how am i notified in advance if if they're going to put me on it do i have due process can i appeal i'll say one thing about the list the us government's not usually good at providing machine readable data in inconsistent data formats they have a tendency to like announce things through a pdf um you can get the ofac list in json you can get it in any format you want it's like well structured and regular they have conventions that they always use

like certain things are in parentheses it's it's great data they don't mess around in this case it's it's it's maybe a slap dash list as far as how it's an amalgam of everyone that the american american government considers an enemy at a given point in time but it's it's good data it's very clean um so you asked a different question about due process in the u.s u.s persons especially american citizens um and there's some gray area about foreign nationals residing in the u.s but let's just say you know american citizens to starve to take the easiest case have what we refer to as procedural due process rights and those are described in the fifth amendment of our

constitution which means it's really you know the highest law of the land even congress can't pass a law that abrogates those rights unless it passes a new constitutional amendment which we only do every 40 years or so to the extent we ever do it at all because it requires really high majorities and the approval of the states so the highest law of the land says the uf procedural due process and procedural due process in rough summary because it's been explained in case after case since the founding of the republic looks like this before there is a deprivation of your liberty or property you should have noticed in other words like a warning this is gonna happen we're gonna take

this action and then maybe after the deprivation but at some point not long after the deprivation an opportunity for a hearing public hearing where the you know the evidence against you can be shared you can bring witnesses impeaching that evidence uh and then a decision by a neutral decision maker um which you know ideally and typically would be what we call an article three judge you know part of our judiciary not this goes to the separation of powers that um you know uh montesquieu and and locke and others started talking about during the enlightenment is that we don't want the executioner to also be the judge and jury and so you know these are the standards

and so you might say okay does ofac follow these standards the answer is not really usually and so then you might say okay is the constitution just a joke no it's just been chipped away at in a couple interesting ways so first of all most people who end up on the ofac list groups or entities are foreign nationals and they don't have constitutional rights under our system and that's kind of kind of a larger conversation i mean this is why guantanamo bay was not located on u.s soil it's a little insidious we'll leave that at that what if you are an american who ends up basically on the ofac list because you're maybe part of a group uh or an

entity that may have some foreign control but also has americans in controlling part of it here in theory you do still have constitutional rights we would hope for procedural due process but there's only a couple of cases and they're mostly about islamic charities holy land versus rumsfeld and um i think haramadin i i may be mispronouncing that versus um us which is an organ-based charity that was um allegedly or putatively um doing education about you know islam and and religious traditions and supporting you know education but may have also been

supporting al qaeda anyway in these situations where some u.s entity is involved the standard for procedural due process is weakened um and these are really there's a there's a saying um bad bad facts make bad law because when you go up before a judge and you're here to defend your procedural due process rights if if the judge thinks you're just an al-qaeda terrorist they may kind of ignore the fact that you're an american citizen so you know i'm not i'm not saying that case law is bad but it's certainly not favorable it basically says look national security needs to be balanced against procedural due process rights which means we can't

erode them completely because that would be an abrogation of our constitution but we can say we don't need quite as robust notice and public hearing and neutral decision maker requirements in the national security context as we do in the typical deprivations of liberty context say under like environmental protection regulation or something like that and there's this this series of factors called the matthews factors which says are there some processes in place where no this is national security so we're going to allow there to be less processes in place but are there some and do they still offer some level of safeguard against abuse of these powers and abuse of our uh procedural due process rights and

honestly these are the processes that typically are in place with ofac so i'm only now kind of getting to the heart of your question like what are the processes in place but hopefully this has been educational typically if for example if for example let's take an example that's that's more that's difficult the easy example is like an iranian national who's got a bitcoin address and is just taking money from ransomware attacks at that bitcoin address the harder example is is something neutral where a lot of people use it for uh legitimate purposes and some people use it for illegitimate purposes we don't have to use crypto as an example here because there have been financial institutions added to the sdn list like a honduran bank for example that might

have been laundering money for the drug cartel but also had legitimate accounts from people in honduras and maybe even people in the u.s in these cases there's usually a lot of work done by ofac to make sure that while achieving their goal which is to sanction the the the bad behavior and the bad people and and also to to push for change in the behavior of those people like ofac repeatedly says we're not just here to punish in fact they say we're not here to punish we're here to change behavior so typically you know folks at treasury would get on a plane and fly to honduras and meet with the directors of the bank

to make sure that maybe the criminal directors are ousted that the anti-money laundering policies are improved that any americans or um innocent hondurans or other internationals who have money can get access to their money they grant licenses like specific licenses for people to take their money out of a sanctioned institution they grant general licenses like all americans can take their money out they they grant letters of um non-application like yeah this is a strong sanction but actually it doesn't apply to anyone who's doing this with the sanctioned entity and before all of this happens they should do what's called a collateral impact assessment

and this is sort of the the lucy goosey equivalent of a of a hearing it's not public it's usually done in private at the agency at treasury but at the very least there should be some administrative record that's private until maybe it becomes declassified that says yeah we we knew that we were going to affect a bunch of innocent persons including some americans who have procedural due process rights and these are the steps we took to mitigate and so the foundational question from a due process standpoint which may end up getting challenged in court with respect to the tornado cash ruling is did you do a collateral impact assessment because it seems like there's at least a probably a majority of the users and certainly a large fraction are

just persons trying to protect their own privacy and not interacting with north korea not doing anything wrong not hackers many of them americans and did you do anything after uh in order to help americans like learn what was going on like even a frequently asked questions page is a typical step it's kind of silly it's not really law but at least it helps right there's no faqs about this did you grant licenses did you work with people to to get their money back to the extent it was trapped in a in a contract that was involved with the section entity and if the answer is no we didn't do any of that i mean query whether we'll find out or not but if the answer is no then i don't

think the the procedural due process requirements of our constitution have been followed okay so um what maybe let's kind of follow this up by a two-pronged question so um how do you get off the ofac list so basically how do i get off if i'm a person who's on the ofac list by say a case of mistaken identity and then how does this translate to the tornado cash situation how would tornado cash who is very much not a person um least of all an american person um get off the list so the case of mistaken identity happens unfortunately quite often um if you have

a a common name especially a name that i mean let's just be honest is um sort of like is maybe saudi arabian by by origin or afghani by origin and you're like john smith in in their language um which i'm not sure what is i'm not gonna guess what that what that is but you will find that you just can't go through tsa security anymore because there's somebody with the same name that is on the sanctions list and and in this case they do a few things they'll say things like weak identifiers this is all we know about the sanctioned person and so we'll put it in quotation marks on the sdn list which means persons um who are enforcing the sanctioned rules like banks and security

checkpoints in airports are not to take this literally they're not to be like everyone with the name john smith has to can't go through the gates anymore and if if there's more information that definitely seems to identify you even though you are not a terrorist then you can apply to have your name removed for mistaken identity or for other reasons or you can also apply if it really is you because you've changed your behavior again ofx says the goal here is not is not um punishment it's behavioral change so if you say like i've i've reformed i'm no longer helping these people launder money take me off the list there should be a process to take you off the list now that process is by all accounts a slow

process and by no means a guaranteed process because it's not like a typical court case where you'll have a public hearing and all this it's an administrative process which in theory you would then later be able to challenge in court but first you have to go through the administrative process which could be slow and drag on and be somewhat opaque but those processes exist now you ask like how does it work in the tornado cash situation that is the hard one because i think it's it's worth and this is something you know we've published a coin center in our in our blog posts about this it's worth dividing what's been added to the sdn list into two categories there are 21 ethereum addresses that are

we are quite certain immutable autonomous robots that nobody can can control or change and so if if the goal is to change behavior you're not going to get a behavior change from those addresses because those addresses aren't persons they can't change their mind they're just software that performs as it's supposed to perform and so a there's never going to be this moment where they can say like yeah now we're screening because they're not a they they can't make these choices and b there's never going to be a moment where they can come forward and say hey take us off the list because they're just addresses on the ethereum blockchain they don't have agency and so to my mind that means that those addresses will never come off the list

so it's actually not about behavior change it's just about punishment and in this case it's not punishment of an entity because there's no entity behind those addresses no one's being enriched by the usage of those addresses it's the punishment of all the americans and foreign persons who want to use those software tools and are now banned from using those software tools and so this gets to this question like if it's not challengeable at all is there a procedural due process problem because you should have at least some process to challenge a deprivation of your liberty even in the context of national security where those processes tend to be less rigorous and then on the other hand there's there's a series of addresses and there's the alias tornado cache and the alias of the website tornado.cache

and some other identifying information that i think of would argue is a group of people who have been working together to build this this tool now you know i don't know for sure to what what extent of is aware that these are people doing something very different than what the blender.io people did because of course the blender.io people were like russian nationals working together they weren't they weren't a delaware incorporated corporation they were a loose affiliation of people as well but they had real control over the asset sets of those bitcoin addresses and they actually actively mixed them to the extent there's anyone behind the

tornado cache entity i suspect this is a factual inquiry which we'll need to actually like people will go through but i suspect they mostly just write software and if all you're doing is writing software and publishing it to the ethereum blockchain can you rightly be the subject of sanctions that's a that's another question and can you say look um this is a mistaken um listing because we we are not uh engaged in the kind of activity that you think we're engaged in but this all is still very opaque because again when ofac adds people to the sdn list it doesn't have a big public hearing

it looks at say the the authorities on the books which in this case are the statutory law aipa and the executive order promulgated by the obama administration the cyber order which says you know people are using many many foreign nationals are using these systems of communication to damage u.s interests to destroy critical infrastructure to steal money from americans or from other persons and if you're facilitating that in some way you can be subject to to to sanctions and so there'll be a whole different case about the folks who've developed that open source software and i don't even know how far that goes also

because the interesting thing about open source software projects is of course that there are hundreds if not thousands of contributors like i'm fairly certain that tornado caches software libraries include like rust libraries for zero knowledge proofs and things like this that might have been developed by say the zcash foundation or might have been developed by some some cryptographer who predates cryptocurrency even like going all the way back to the early days of just crypto means cryptography and so how far back do we go in the chain of software contributions to define the entity can you really be sanctioned merely for publishing code and then the bigger question i think is actually going to be like did they do

things beyond just publish code like yes they someone was paying for the the dns registration for for the website somebody was probably paying for hosting of the you know the gui the the front end are these the kinds of things they're still kind of like speech um but they're also sort of marketing speech and and helping people use a tool at what point are you sufficiently helpful in getting people to use a tool especially if those people happen to be criminals that you're liable for something like money laundering and and properly the target of sanctions okay super interesting background so um

i i think we kind of we have a good grounding on ofac now so let's talk about the thing that tornado cash in a way is being charged with so anything besides the press release um that that we know basically what what um uh what the ofac body thinks tornado cash has done wrong no there's really just the press release and the fact that the sdn loss now contains the alias tornado cache so this is this is again why things are different here than the typical procedural due process context where you get notice of actual specific allegations against you and so the press release just says that

they facilitated money laundering uh by north korean um cyber criminals right and and it is i believe established by like blockchain forensic folks like chanalysis and others that the lazarus group in north korea did use the tornado cache tools to launder some ethereum or maybe it was usdc i'm actually not sure um and so that's the that's the level of specificity we're working on there was a there was it's worth noting that right on the i think the day or the day after the the announcement the press release was dropped there was a tweet from the us secretary of state that said tornado cash is a great is a

group of north korean hackers and you know the tweet was was immediately deleted or actually not immediately it stayed up for a while which is sort of libelous uh quite honestly um but i think i think somebody realized that like some intern had tweeted on behalf of the u.s secretary of state and conflated the users of the tool with the the tool itself because from what we understand the tool itself is not developed by north korea and we're actually quite sure of that you know so these allegations are just sort of diffuse and nebulous and damning but very non-specific charges it's worth noting that the stuff that showed up in the in the

sdn list doesn't include the names of any open source software developers even though several people have had you know have had github accounts where they've in their own name contributed to the software have have talked about the software and the tools on twitter um none of these people are named are they the group that is tornado cache i don't know they weren't specific about this typically there's specificity like when the bitcoin address addresses for iranian nationals were added to the effect list the names of the iranian nationals showed up and so like we just have to guess and frankly and you know i have to be careful here because i

don't want to be making assumptions about the the people in ofac and and how how well they're doing their job but the addresses that are identified as being tornado caches addresses happen to perfectly match the ether scan addresses that are tagged as tornado cache which seems to indicate that that was the source for the investigators in figuring out which addresses to add to the list and i think it you know to anybody who doesn't know etherscan is kind of like a wikipedia tool users of etherscan can tag addresses to describe what those addresses are it's not an authoritative list so it is in some ways if this was the the the

research that was relied upon for the investigation it's in some ways like citing wikipedia for your investigation rather than citing a real source the tornado cache documents like technical documents actually had a much more comprehensive list of ethereum addresses that are related to the project several of which didn't end up on the sdn list so this is not being done if you ask me in a rigorous legalistic easily challenged manner it's being done in the sort of fog of war that tends to exist around u.s sanctions policy um so um brian nelson he's the undersecretary of the treasury for

terrorism and financial intelligence um he said um following the ofac press release on tornado cache he said um despite public assurances otherwise and i'm quoting here tornado cash has repeatedly failed to impose effective controls designed to stop stop it from laundering funds for malicious cyber actors on a regular basis and without basic measures to address its risks treasury will continue to aggressively pursue actions against mixes that launder virtual currency for criminals and those who assist them so um maybe let's talk about what uh brian nelson thinks um the tornado cash folks should have done because as

far as i'm aware only in april um the tornado cash front end actually blocked um ethereum addresses that were on the ofac list from using um its front end to access the smart contract so what exactly um should should the tornado project have done to mitigate um the alleged laundering of money or i think we can probably say that you know laundering of money has occurred so what should they have done um and do you think they were contacted previously and and encouraged to do this or

what do you think happened here in the background that all of us are not privy to yeah yeah so going back to my honduran bank example there typically would be some contact beforehand and some active collaboration between the the sanctioned entity if it's an fi if it's a financial institution and not just an iranian national or something like that to like work to try and change behavior again rather than merely punish i don't know if that happened in this case i will say that the choice of the phrase despite public assurances i i think we can guess the choice of that phrase is deliberate so that

there weren't private assurances made um would be the negative implication of that maybe there also were but they're just not discussed in the press release and by the under secretary but the choice of the word public assurances seems to indicate that maybe this was just something that they were doing on their own um i'll tell you that like any u.s law firm worth its um worth it's a a bar to practice law would tell people like oh you're creating a front-end website to help people use a technology tool where they can move money you should probably follow ofx sanctions so it's it's not unreasonable to think that the the the remaining parts of tornado cash

that are centralized and run by persons and persons who may be u.s persons or may have us attorneys even though they're foreign persons because they want to work they worry about all their contacts with your u.s jurisdiction took these steps right and so what are these steps you you described them to the i don't know any more than what you described which is that the front end at least and and maybe some of the proxy contracts on the ethereum blockchain rather than the actual immutable route contracts on the ethereum blockchain um we're using chain analysis um oracle for sanctions compliance in the way that they were allowing people to to to use the front end and that means that you could still

um using an ethereum client and and say the command line or any number of other ways to interact directly with the ethereum blockchain use these tools even if you were a sanctioned address but you wouldn't be able to use that front end which is the part that in theory is still controlled by the entity which we'll call tornado cache the developers or the persons paying for the dns registry and things like that and so to me that that is a step towards sections compliance and the fact that this step is perceived as or was not just perceived but like found insufficient by ofac which is why they took this more drastic step to just add the whole thing um add the diffuse name tornado cache to the sdn list was

insufficient it kind of indicates that maybe i don't know what else they're expecting maybe they were expecting that they'd be able to change the original root contract the 21 addresses that actually do most of the mixing and don't have admin keys that allow update ability and if that's the case then they're asking these people to do something that's impossible they're asking them to to break the ethereum consensus rules uh on their own which is not something that an individual can do on their own that's that's how these systems are architected so you know i i don't think i think this this goes to this larger question of in a typical ofac sanction against an entity that is not a criminal enterprise but rather a

legitimate business being used by criminals along with legitimate customers there would be this give and take this cooperative effort to just try and make things okay um you know specific licenses generalizes collateral collateral impact assessments but it doesn't seem like that's happened here if we just go by the the public statement which is that there were some public assurances and we don't think there are enough let's look at maybe the clients of tornado cash right or the users of tornado cash so um in the media there were different numbers flung around um in term basically alleging um you know what proportion of funds that were funneled through tornado

cash were elicit so basically um seven billion went into tornado cash in total um and depending on where you actually got your numbers from it said um that between fifty and seventy percent um of the volume was um illicit and the rest was listed if you look at the um chain analysis report it was more like 25 or 30 that were it is it still a large chunk right so um where's um is there generally um a an accepted level of abuse of a system so the entire system is not

automatically seen as um uh malicious um because i mean at some point you kind of i mean i don't i so basically as much as i am an advocate of privacy and um being i mean i mean i i i don't like the north korean government as much as the next person right i mean they do horrible things i mean i think probably some sort of sanctions are in order and uh i mean this is kind of for me it's like a little bit of the you know are we the baddies um should should we kind of should we change our ways so what's kind of what's the acceptable level of misuse of the tools you build

you know for someone in the sector or in any sector really so i think there's something really pernicious at work here that's much deeper and so this is more just me peter talking about my ideas about decentralization unless me talking as like a policy expert or coin center but uh and i've tweeted a little bit of this um when you have a base layer like bitcoin or ethereum that is public by default like fully transparent and you know i mean if you look at the original bitcoin white paper satoshi wrote i think is section 10 on privacy and says um it's kind of private because you have pseudonyms instead of your real name but

if you keep reusing the same addresses or even you know that there's change from a trend utxo some of it flows back to other addresses you control you you could be identified and this could be a problem and so satoshi even knew back then that these things were fairly transparent and obviously with the rise of blockchain analysis um these things are incredibly transparent especially especially to somebody who's got enough money to pay for a high-end blockchain forensic tool they can learn everything about everything you do and so the problem with these networks right now is the default is no privacy a person who's just sort of playing around with the technology or using it for small transactions or

innocent purposes like because they want to have a ens domain name and they want to buy a silly nft and play with their you know their friends online uh these people get no privacy by default the only way to get privacy is to take really difficult additional steps and those additional steps are you know use a tool like tornado cache which is an address you know a series of addresses located at a small part of the ethereum blockchain um move money through that move tokens through that and then withdraw them and you know it might be somewhat user friendly but it's not something that an ordinary person is going to do

and so who gets the benefit of anonymity on these networks it's people who have a lot of money and therefore start to realize the value of privacy and they might be totally legitimate people who have not committed any crimes and deserve privacy but query why the rich person then gets privacy but the small the small user with only a few eth or fractions of an eth don't get privacy and as other people who have high demands from their technology which are of course criminals also have high demands from their technology because they don't get the benefit of courts of law or property rights or other things and so they're going to use technology to protect their property rights or their contractual rights

um and so they're going to have the benefit of anonymity and this is a really perverse outcome it's the exact opposite of what we would want if we were a society that as bernard shaw said should be judged by how it treats its um least wealthy persons those are the people who should have privacy small users small individual users of ethereum for social good or for their own purposes and you know i think probably everyone should have privacy because i don't believe we should be interposing intermediaries that can sort of arbitrate the law before court even gets involved and block transactions before anyone's been convicted of a crime but at the very least we've got this this calibration backwards and so you know my only response to like

to directly answer your question no there's no like magic number of 10 or 5 or 15 percent where now we're just going to call the thing a criminal enterprise um that doesn't exist in the law there's just this risk calibrated anti-money laundering program which means people will make their own decisions and risk-averse bankers will make very extreme decisions unless it's their own self-interest that they're protecting in which case they might happily launder money for russian oligarchs because they do but but to me this this conversation misses the point like yes of course the tornado cash addresses happen to have more illicit transactions in them than your typical ethereum addresses but that doesn't mean that we shouldn't have privacy and in fact

that's just evidence of the sad state of privacy on these networks where the only people who go and seek privacy are people who have really uh a lot to lose either because they're rich for legitimate reasons or they're criminals and so i just think it's the wrong inquiry i think i would follow that almost all of the way but say if you actually took this to the extreme and you had a thing that had like 99.9 of you know illicit activity and you know no legitimate customers at all do you think would you still argue that on you know on principle well what is that thing so that's that's the other hard question here like if

that thing is is is a human is a lawyer well actually i mean a lawyer is interesting all the lawyers customers are criminals right but we still want that lawyer to be able to defend you know criminals right i mean they're not yet criminals they're accused of being criminals in general though like if what we're talking about is software if literally the only users of software like 99.9 of the users of the software are criminals should we just ban the software i don't think we should ban software i don't think that that i don't think it's a it's not a sensible way to stop crime because the only thing you're going to do is prevent innocent people from buying the software or or interacting with the software and

criminals are already criminals so they don't care if you ban the software they're going to find copies of it somewhere and they're going to use it for their purposes so like the inquiry here we need to be specific like if the entity that we're saying is doing 99 of their business as money laundering and only 0.1 percent as legitimate transactions is jp morgan a for-profit company that's all kinds of tax benefits and other favorable treatment under the u.s laws then yeah we we should definitely sanction jp morgan or or or deutsche bank or whoever deutsche bank did launder a whole lot of money for russian oligarchs like billions um [Music]

but if the entity is software then we're not actually sanctioning some person or thing unless we say well you because you wrote this software you're now guilty for all the things people do with the software in the future that that's a recipe for destroying um people's desire to innovate like like like if i invent a new material because i'm a material scientist and i know it might be used in the barrels of howitzers to make you know it easier to shell cities and i'm worried that the collateral consequences of my invention will mean that i end up in jail i'm just not going to invent new materials even though these materials also might be the thing

that allows us to i don't know improve crop yields or fly to mars or any number of other things like we can't start getting in the business of saying like your tools are too good they're too powerful and we believe that the human human race is so uh riddled with evil that it doesn't deserve better tools like that's that's nihilism let's talk about good tours right so basically this kind of this reminds me of the entire pgp saga um you know how how um the us government insisted that pgp was too powerful a technology to be in civilian hands and that it really was like

a weapon um do you think this comparable this is like that yeah yeah i think i think we're headed down a road where it's comparable right i want to point out a couple details so what you're referring to is sometimes casually labeled crypto wars or crypto wars one because maybe we're now in crypto wars two or even three depending on which incidents you're you're counting and you know some of the the amazing moments in that in that first battle were you know people would say look it doesn't matter if it's a powerful tool and you classify it as a weapon as munitions it's code and code is speech and people i think adam back was one of them

actually people printed up t-shirts with the actual pgp or maybe it was rsa in pearl the the raw characters on the t-shirt at which point if you walk across the us-mexico border wearing the t-shirt you violated munitions export control laws and so it sort of illustrates the point this also ultimately got fought out in court in a couple different cases in different circuits the most notable one for the pgp stuff was um uh bernstein versus the doj in the ninth circuit in the california courts and bernstein who is a cryptographer and an academic researcher won because he was literally publishing pgp in a book

and the court said look we have the first amendment in this country you you can't have prior restraints on speech and a licensing requirement to allow academic researchers to publish their code is a prior restraint on people's right to to speak to speak of ideas that are there to communicate scientific or historical or other knowledge about what it is to be human and how to make life better because if we start going down that road of having a government sensor for all that information we lose everything that makes us different from our enemies we lose everything that makes us i would argue better than the north korean government um this is a little different though in a few ways that are very important so that's just background

first the statutory ground that ofac is using to designate tornado cash and block americans from using that tool is the international emergency economic powers act instead of the i itar international trafficking and arms regulations these are different authorities the aipa is about blocking the property of foreign nationals itar is about designating certain technologies as weapons in both cases some of the results are similar if something is designated um a controlled weapon or munition

then americans aren't allowed to freely move it in and out of the country publish it widely on the internet things like that if property is blocked because it's a foreign national whose sanction has an interest in it then americans aren't allowed to interact or transact with that that foreign property but itar is designed to deal with technologies whereas aipa is designed to block and limit property and and foreign nationals and transacting with foreign nationals so to me if ofac really wanted to do what they did which is identify at least 21 ethereum addresses that contain open source code that is not

under the control of anyone but can be used by anyone and shouldn't be used by anyone because that's basically what they're saying as americans shouldn't use this technology then they should have designated it under itar as in munitions and said you know americans aren't allowed to traffic in this instead they said this is the property of a foreign national which we're going to argue possibly in court is not true because the foreign national in this case to the extent there even is one doesn't actually have control over those 21 ethereum addresses and so so that's how this is subtly different the legal challenge is going to be different here we would make a statutory argument you've exceeded your authority under

aipa maybe you had the authority to basically do the same thing under itar but you didn't do that you abused delegated powers from congress in aipa to do something that should have been done through another avenue whereas in the itar context like the bernstein case you're going to go straight to constitutional arguments and there's something kind of insidious here because the tornado cache software is identifiable at an address it looks a little like property because you know what exists at a regular um bitcoin address or a regular transactional ethereum address rather than a contract address property like to the extent it's not empty if i send some

eth to an address that's a regular address there's property there here this is not how those addresses work to the extent there's property there it's property that's been sent through the contract the contract is just software logic that controls that property and actually the american if it's an american using it for legitimate purposes is still the sole person that can ever remove property from that account so there's no foreign nationals property here and so i i think it's inappropriate to use aipa in this case but but to be clear they're also not doing the itar thing like if i want to go and take the source code of the tornado cache smart contracts the solidity code or whatever and just

start printing it on t-shirts or sharing it online on my blog i haven't violated the law i don't think some people might think i've violated the law because they're being extremely risk-aversed in their risk-based anti-money laundering um program but aipa didn't say you're not allowed to publish this code anymore in fact aipa has a big carveout and this is interesting it's called the berman amendments after the congressman that introduced these amendments when aipa was passed that says you're not allowed to block or limit the exchange of cd-roms or information music records things like this they didn't get up to open source software libraries because this wasn't you know in the

1990s this was back in i think the 70s um well no cd-roms must have been the 80s i should check that out but anyway you know there's a carve out for speech activities in aipa and so that could become very relevant here if there was an attempt to over interpret the action saying not only are these ethereum addresses not allowed to be transacted with you're not allowed to take the code at those addresses and share it widely online or something like that why do you think tornado cache was targeted rather than some of the other privacy enhancing tools in web3 so things like zcash aztec monero

why tornado two big reasons one is because of blockchain analysis we can see north korean hacker money from ransomware attacks flowing directly into the tornado cash contracts right and this is the really bad outcome you get when the base layer is public by default and you can see people seeking privacy and then they might get some privacy but you saw the money going in now the government has this obvious target for this thing that's providing privacy including privacy for hackers and maybe they don't a recognize that this thing is just a tool and not a business so

they're confusing blender.io and tornado and the way they work and so without thinking too much they're just like add another mixer to the sdn list because we can see the funds moving into this just like we saw the bitcoin funds moving into the blender addresses or maybe they also don't care that it's different in this context they still know that they can point to a discernible thing on a blockchain which makes it look like property even though it's just ideas and they say like well you know americans shouldn't be able to interact with that address very different to say americans can't interact with the zcash protocol full stop because what you're basically then saying is americans can't use a whole

stack of technologies that start start at the network layer and work up they're not allowed to they're not allowed to what install the client on their computer they're not allowed to use the client to transact is that different than i mean this is a hard question is that different than you're not allowed to use the tornado cash smart contracts the fact that there is this address that can be added to the list makes it seem different because the address looks like property even though we would argue it's not whereas saying like the zcash client software and any transactions that you'd make using it starts to look obviously like technology in which case they should be using itar and not iepa because you're not blocking

property to the extent you're blocking property you're blocking a massive open source mit licensed software uh intellectual property that isn't actually owned by a foreign national because it's a massive open source project i don't know let's look at how the ecosystem has reacted right so basically um if you look at the status of tornado cash now obviously the smart contracts are still up because they're immutable um the centrally hosted interfaces are down predictably i it's still reachable on ipfs in principle um lots of rpc endpoint providers actually

sensor transactions that go to tornado cache notably alchemy and infuria which is um what a lot of services use um github has has frozen or deleted the accounts of the tornado cache developers um the ydx has blocked accounts that have interacted with tornado cache in the past um soccer has frozen usdc on accounts um that have interacted with tornado cache in the past um to what extent do you think this is over compliance i mean do they actually need to do this as an rpc endpoint

provider do i have to um censor tornado cash addresses as ether scan can i still show tornado cash contracts what what what's what's the what's the line in the sand here yeah so under aipa and under ofac rules you're not allowed to transact um with the designated foreign national or their property right and so we'd argue that the whole thing with respect to at least those 21 addresses that are under no one's control is already over compliance because those 21 addresses actually shouldn't be on the offec list to begin with but we

would say you need to challenge that in court and you probably shouldn't violate the law until we get a ruling from a judge to the extent that like there is a an entity here that's the legitimate target or the legally a proper target for sanctions like what is over compliance again there's no hard and fast rule here because it's not like there is a black letter standard of this many hops away from a sanctioned person is an okay transaction and banks historically in the more traditional context you know when they find out the beneficial owner of an account and they realize that they were also

sat on the board of a criminal enterprise um even though they themselves might not have been you know maybe they you know they're going to take certain risk judgments and take certain steps in in relation to those risk judgments so it's hard to say i think of all the things you mentioned there are ways to make distinctions though so to the extent we believe that all the property in the tornado cache addresses is actually now legitimately the target of sanctions then accepting that property in trade is probably you know the most obvious violation of sanctions like accepting a transaction from tornado cash which is funny because the way

ethereum works you don't even necessarily accept it it just shows up in your wallet which is the dusting attack that jimmy fallon and shaquille o'neal have you know received property now but like that's the most obvious like violation right if all you're doing is relaying information about the state of those contracts um i could see why a compliance officer in those you know companies would say yeah just don't touch it just don't even look at it but really you're just like reading the ethereum blockchain and telling someone else what it says right and at that point i have trouble believing that that that kind of compliance is the right kind of of compliance um i'm not the lawyer of infira or anyone and i wouldn't

necessarily advise that they keep doing what they're doing but you're really just an information relayer at that point you're you're doing information relaying in a way that helps people ultimately make transactions and so maybe you're assisting or aiding and abetting the violation of sanctions like that's probably the legal hook that they're worried about but that becomes absurd at a certain point and like a few things like again there's this berman amendment in aipa which was the carve out for speech activities it's worth noting that section 3 says nothing in this law applies to the importation from any country or the exportation to any country whether commercial or or otherwise regardless of

format or medium of transmission of any information or informational materials that's actually a really big carve out and they then go on to mention all the mediums like not limited to publications films posters phonograph records microfilms microfiche tapes compact cd-roms artwork etc wirefeeds is actually listed there newswire feeds though not banking wires and you know this is an avenue for future research i don't know all the facts here but from my understanding the swift network which is you know used for international banking settlements has has in the past i've been told so this is hearsay but has in the past i've been told argued that they're not

obligated under um of restrictions you know in a 100 percent kind of like always avoid dealing with parties way because they are quote unquote on a communications network you know they're just relaying messages of banks and the banks need to comply with ofac but to be a neutral communications network we can't sort of do that sort of like address by address or bank number by bank number type sanctioning and control and so to the extent swift has made this argument in the past and again it's sort of hearsay i've i've heard that they have but i i don't know specifically where and specifically how i think the same arguments should apply to an rpc provider to an inferior to a minor on the ethereum blockchain um

to all of these sort of people who are third parties to these transactions and they're really not they're not actually directly facilitating the transaction they're just helping people understand the information they need to understand in order to make the transaction they're really communications providers they're not actually they're certainly non-custodial they certainly can't change the transaction because that would violate the rules of the consensus mechanism they could block the communication that ultimately effectuates the transaction but that really is just blocking communications which under the berman amendment seems to be something that's carved out of the ofac powers rather than in the ofac powers what about if a sanctioned address actually

um send money somewhere or made a transaction they would pay fees right they would pay fees to the network would that kind of change the situation because then as basically as as a network provider as um as a miner or validator or um yeah as basically part of that communications realm i i would be accepting i would be accepting tainted money right this this this is great because this is now i know exactly what i need to research because federica is asking me the hard questions um swift charges interchange fees right i think so now maybe this is where they actually

start obeying sanctions is if if a bank is actually designated as a sanctioned entity they'll probably be like okay now we're definitely not going to accept you know fees from you because we'd be accepting um money from a sanctioned party and that's different than we think some of your customers might be subject to sanctions but we're just taking fees from the bank intermediary so maybe that's that maybe that's the dividing line i don't know but the mere fact of accepting fees doesn't necessarily to my mind invalidate these carve-outs from ofac because it's pretty clear here the importation from any country or the expectation to any country whether commercial or otherwise it seems to encompass not just like

political speech that someone's you know shouting from the rooftops because they're a good person it could be you know a data market with data brokers and i'll add that under first amendment law here in the u.s as it's evolved over the last 10 15 years one of the most interesting recent cases about first amendment rights was the supreme court threw out a vermont law on first amendment ground saying and what vermont was trying to do with that law was ban um prescription drug detailers so marketers for prescription drug manufacturers was trying to ban them from trafficking and buying and selling prescriber identifying information like the the records that show which doctors are

prescribing which drugs there are whole marketplaces for this in the us because we have a somewhat insane healthcare system and vermont was trying to say you know like academics and researchers can buy and sell this information to do research and generic drug manufacturers can buy and sell this information but but for-profit prescription drug manufacturers are not allowed to have like a marketing arm buy and sell this information and the supreme the supreme court said uh that may be like you may think that that's legitimate regulation of the prescription drug industry but you've actually just created a prior restraint on speech and you're not allowed so they just threw the law out so you know if that kind of very commercial and to me very

non-sympathetic first amendment activity like i don't find drug manufacturers very sympathetic in this case if that's protected speech in the u.s then then i have trouble not being sort of even-handed and saying operating an ethereum mining client um is also protected speech doesn't matter if like some of the stuff that gets bought and sold over that information or their communications channel is is you know unhealthy or bad for america you know i don't know it's a little bit um difficult because because it's i mean it very clearly seems to be the case that when it comes to ofac

people are scared shitless and over compliant so basically say if you are a a validator and basically you're afraid to validate um a block with a tornado cash or they need to cash like transaction then there's the attesters right on ethereum too so there's like 500 people who who need to say yes this is this is correct if if basically if if it starts falling apart at that layer we have really big problem i mean you don't want to be the person that an example is made out of right so it's i kind of i kind of see where

people are coming from but i think it's kind of we as a community probably just have to say we will have to hold our ground here yeah i would also say that that's probably not a good way to design consensus mechanisms and i i think that's a huge thing to say because there's like a lot riding on ethereum's movement to prove a stake but like asking real humans to attest something and all of the real humans to attest to something oh it's validated right so the validators have to attest so basically the validators they have to say look look this is correct we saw the same thing yes those are those are real humans right

and i know the goal uh system yeah i mean it's a client yeah yeah but they they're people that control the computers they're real humans and i know the goal of that system is for them to just run the software correctly which means anything that's valid according to the consensus rules which are written explicitly gets an attestation so i know it's meant to be just is it is it accurate according to consensus rules in which case automatically a test but the fact of the matter is humans control those computers and so they are capable of deciding whether to attest or not based on information outside of the consensus rules yes and

so that's an attack vector that's a problem and so i would argue that like this is not a great way to build a consensus mechanism if the goal is for the network to reach consensus over certain fundamental rules and not the subjective or jurisdiction by jurisdiction based opinions of the people operating the network i don't think bitcoin's all that much better honestly just to be fair to ethereum people because there is actually a choice within bitcoin as to what chain tip you build on top of w where you perform your proof of work like you could say i'm only going to do proof of work calculations on top of a blockchain that doesn't have sanctioned transactions in it and then that would also that would

cause a fork in bitcoin as well it's a little bit more abstract the functional result is is very similar um but maybe because it's more abstract it's okay uh even though by taking this action just deciding to do my proof of work based on this as my inputs i'm adding to the probabilistic finality of these transactions some of which might be sanctioned transactions in both cases it's bad and this is something that i think has been under discussed in the cryptocurrency communities which is you know privacy for human rights is one thing privacy is also important for consensus like miners

and validators should not even be aware of the data that they're validating aside from the limited facts that are relevant to consensus and to the extent they can become aware of other facts this thing's not going to work in the long run and that's something that i think is actually like a hidden benefit of say z cash where you know the validator is just checking a zero knowledge proof and that that zero knowledge proof is the is the state change that makes all manner of transactions happen or not happen on the blockchain and the validator doesn't learn anything about the specifics of any of those transactions so if you really want to build

an immutable machine for freedom and individual choice that doesn't bend to the particular jurisdictional desires of the ccp or the us government or germany or you know tom and his prejudices at a big corporation then you can't build a system where consensus you know allows the validators to learn a bunch of additional information about what they're reaching consensus over i think this is a very fair take and basically we will we as a community will have to discuss this at length i fear um particularly over the proposal builder separation because basically there um the way that blocks are assembled

the basically there will be very few entities who will actually it's likely that there will be a recentralization of entities actually proposed blocks so yeah i mean if there's you know only ever three different proposals yet this is horrible so yeah i think we this is something that we really need to terms with and we need to come to terms with um we've we've zoomed way out i kind of want to circle back for last round of questions um about tornado cash so if i have money on in tornado cash what do i do now if i have an address that has um inter asking for a friend by the way um if i have an address that has interacted with tornado cash in the past

is this you know you know past redemption should i deprecate this and kind of uh try to uh launder this you know the other way via centralized exchange as long as they still can um what do you think i mean are you an american absolutely not what should i do if i'm an american yeah i mean so if you're an american the the sort of simplest reading of the law is you really shouldn't take your money back out if it's still in the contract because it's going to be a very direct example of you know there's this sanctioned alias and you're going to argue you've just

sanctioned me you didn't sanction it for an entity because i'm the one that controls the funds in that address no one else controls them but that's a nuanced argument that requires that law enforcement and ofac understand the nature of what they've just sanctioned and maybe they don't fully understand it so don't like force that force that argument to happen unless you're ready to do it in court um i wouldn't just go and like uh it's silly the way they did this i'll take the money out because then again it's a willful violation of sanctions law potentially which is a 1.5 million dollar maximum fine and 30 years in prison maximum jail time which is pretty intense so

if you're an american don't i would say if you're an american especially reach out to the electronic frontier foundation reach out to fight for the future reach out to coin center because and i think coin center especially might be focusing on this due process challenge where americans who've done nothing wrong have their funds locked and you know we're very up front we're talking with our lawyers um about potentially bringing a challenge we've received coin center has received tornado cash donations in the past um because we're a non-profit that defends people's rights and people sometimes want to donate privately to nonprofits and actually under the u.s

constitution you have a right to donate anonymously to a non-profit because back during the civil rights movement when alabama tried to get the naacp's donor records for very bad reasons because they'll show up at your door wearing you know potentially clan masks like the the the supreme court said we we cannot have a a world where the government can just unblind and de-anonymize all the donors to civil liberties organizations because we won't have progress in society then so like if you're an american that uh has money locked in that contract you have standing i think to challenge this designation and coin is interested in challenging this designation on

statutory grounds that the designation actually exceeds the authority in the statute because it's not sanctioning property that a foreign national has an interest in its sanctioning something that isn't property and that a foreign national doesn't have control over and so it's it's not allowed out of the statute i think other people who have standing are actually people who got dusted i made a joke about you know jimmy fallon and shaquille o'neal they had you know dot eth addresses uh they were highly you know uh public about them because of the nft craze and because of other things and they've received i think each of them 0.1 eth through tornado cash and that immediately creates

very serious legal obligations for the receiver under ofx regulations if you accidentally or unintentionally receive sanctioned property you have 10 days to file a report with ofac or else you're in violation of ofac and you file a report and segregate the property from your other property not touch it don't even look at it send it back no actually don't send it back because then you're sending money to a sanctioned party uh you know so these people also have standing to challenge it because by virtue of simply receiving the unwanted transaction they've they've now got very serious obligations under the law which isn't which is an injury which means

that you can you can challenge the law uh and also anyone who um has used it in the past and intends to use it in the future as i said coin center has received donations the past we intend to receive donations in the future using tornado cash to the extent we can by law we have standing to challenge so that's that's maybe the unsatisfying answer because you just want your money out of the damn thing um and you didn't do anything wrong it's not criminal money it's your money um but i think the the wise thing to do would be to challenge it in some process in court not to just go ahead and take your money back out because that would probably be very unwise from a legal standpoint what about non-americans yeah non-americans

i mean if it's a big chunk of money especially but maybe if it's a small amount they should talk with their lawyers i'm uncomfortable giving an answer there because i don't i don't know their particular situation like they could be in some ways under us jurisdiction because of certain contacts they have in the u.s business interests they have in the u.s and so an extreme aggressive approach from the u.s prosecutors could be to use long-arm statutes and extradition to get control over people who violate sanctions even if they're not um typically understood american citizens that's that's a very me giving a very cautious be careful response um i think in general to the extent you

really don't think you're under the us's jurisdiction which is always a dubious thing to assume no matter who you are in the world um if you were to take the money out of the contract yeah then you're gonna have a whole other suite of problems which is that all the intermediaries that still fill the gaps where decentralization hasn't you know removed their authority are gonna they're gonna treat you like a sanctioned party effectively or party to a section party um and so you could take it out very well and it's just going to sit there on the ethereum blockchain stuck forever because you can't send it to an exchange you can't send it even to a lot of d5

protocols because they've taken this very aggressive compliance measure to to block usage of their front ends or their protocols what about addresses yeah that have interacted with tornado cache in the past so here's some here it's good we've got some good news um if you interacted with tornado cash in the past before the sanctions you you're not in violation of any laws the one thing we know for sure is that sanctions law as draconian as extreme as it is is not retroactive and if it if it if it had retroactive application i.e everyone who's transacted in the last 20 years with this entity is now a criminal even

though it didn't say anything until now if it was retroactive it'd be unconstitutional as an ex-post-facto law which is also in our constitution but am i under an obligation to know about this obscure american you know sanctions list as you know a an unconcerned european citizen just minding their own privacy [Laughter] sorry that's a little bit of a leading question here no i want to say no but at the same time if you're like conducting a lot of business globally you probably do know about it yeah i do analysis has an oracle you know chanalysis has an oracle that you can use on the ethereum blockchain to

identify sanctioned addresses so like okay final question peter um alexei one of the developers behind tornado cash um was arrested a day or two after the press release came out in in the netherlands incidentally um what does the future look like for him i mean what's and the rest of the tornado team i mean what what what does he have to fear being you know a non-american in the netherlands yeah i'll start with the general question um what does the tornado cash software developer team

have to fear to the extent there is an entity tornado cash right it's hard to believe that there'd be anyone identified as the actual people in that entity other than the software developers maybe some other people as well but like to the extent there's anyone behind tornado cache it's software developers right in the u.s they're gonna have constitutional rights um we have pretty strong free speech protections i'd argue the strongest free speech protections in the world um it's one of the one of the remaining good things about being an american um and so they're gonna need to like like to the extent any legal action

is taken against them uh because so far there haven't been any arrests by americans in america of americans um they'll need to defend themselves using the first amendment as an affirmative defense i think and that could go in different directions and a lot of it's going to come down to the facts of what they did if all they did was publish software libraries i think there's actually really strong first amendment defenses if they sent even one email to a actually sanctioned person like at the lazarus group or whatever explaining how to use their tools and encouraging them to use their tools then that starts to look much worse you know and

i don't know any of the facts and so there's a whole range of behaviors that on one end are the pure publication of information like bernstein publishing pgp as a book obviously defensible under the first amendment and at the other end like maintaining a website and explaining to a north korean how they can use that website to launder money and first amendment defense could be somewhere in in between those two extremes it's not gonna it's not gonna be willfully helping a north korean to launder money um but it's also not going to be it's not like you're going to lose your first amendment to defense because you publish code in a book so somewhere in the middle they're going to have to form

their defense for the the arrest in the netherlands i don't know uh i don't know dutch law my last name van volkenberg is van volkenberg because some dutchmen decided to leave the netherlands back in the 1600s and settle in new york from what i understand and this is something that like folks who are concerned about this should read more about from actual dutch legal experts or experts in the netherlands from what i understand the netherlands has a negligent money laundering charge that they can bring against people which is unusual there is no similar criminal statute in the u.s

money laundering is definitely illegal in the u.s but it is a specific intent crime which means you need to prove that the person you're accusing of money laundering had knowledge and specific intent to obfuscate or hide evidence about some specific flow of funds related to some specific criminal enterprise you can't just say ah because you built tools and anyone could use them for anything and you didn't stop people from using it for bad things you're negligently laundering money and i don't know if that's the predicate of the dutch statute but when i hear negligence i hear there was no intent the

the barrel fell out of the warehouse and hit the person on the street you didn't intend for that injury to happen but because you didn't have a railing in place you're liable as the owner of the factory like if that's actually the way the dutch statute works then that's very frightening and i'm surprised that there's a criminal statute like this in the netherlands because i yeah i i don't know how you defend against that it seems to create an extraordinary extraordinary obligation on people who are engaged in commerce or trade or other activities like always make sure that the person you're transacting with isn't trying to move money through you

uh because they're trying to hide it from from criminal dealings it's like really am i supposed to just like when i go down to the corner store and be like hey guys i know you mostly sell bananas but i've seen some shady looking russians in your back room are you actually a front because if so i don't want to buy your bananas like that's nuts um but that is in some ways like like an extreme version of a negligent money laundering claim so i don't i don't have a good answer um but i i hope that the law isn't as bad as it looks from my untrained eye we're totally over time and it's been a rather solemn episode because it it's such a it's such an all-encompassing topic

right privacy and the right to privacy um we've recently had brad scotton who wrote a book cloud money about um basically his his hypothesis is that um big finance and big tech kind of merge and kind of leave us all without um privacy squeezing out um the last remaining pillar of privacy and you know transactions for regular people namely cash um and i mean yeah so i mean i would actually say that cash very much falls in the same category for me as privacy uh preserving cryptocurrencies

to me they're kind of the same bucket so um yeah it's and he he also had a really dire take um on where we're at and where we're headed yeah i started reading um cloud money it's excellent all right i was actually reading it on the plane to um z-con and then at z-con is when the tornado cash um thing dropped and so i haven't i haven't gotten more than halfway through it but uh brett's great um brett's a straight shooter and and his analogy between cash um and and private and tools that protect privacy is dead on

because you know the only reason we have this massive surveillance apparatus and this the massive power of ofac and sanctions law is because we've mostly abandoned cash as the main tool for settlement yeah since the 1960s and and onward um and i i the thing i always like to point out to people is like you think that i'm some sort of like people who are critics you think that i'm some sort of anarchist who wants to see the world burn or something and that by advocating for privacy i'm secretly advocating for chaos the world of like the early 20th century for all of its injustice with respect to individual rights and like especially the rights of minority persons and and

women at the very least though like people were allowed to use cash and it's not as if we had like manifestly more crime than we do today like like there's lots of reasons why i'm glad i live now and not then but like random crime and criminal acts is not necessarily one of them at least not in the us or in europe or in a lot of like industrialized nations and so i don't think that like a return to that transactional architecture where most transactions are made peer-to-peer using hopefully what we call electronic cash uh jerry wrote a good paper about this like zcash and and even eth if you're using it through

tornado cash i don't think that is a return to some lawless hell it like the world was very ordered back then in some ways the order was bad for other reasons but not because of cash so i know i think brett's right the world has changed radically and not for the better with respect to that aspect of our liberty yeah i i think this these are good closing words peter um if people want to find out more about the work you guys do at coin center or donate maybe even privately um where can they do that so we're just our website's coincenter.org we have a donate page that has um anonymous donations as a as a as a

possibility it's just an ethereum address so you can send money to that address um we also accept other cryptocurrencies um and if you want to find out more about our efforts to to challenge this action and and and other work we've been doing to challenge 6050i a whole another legal challenge we've already brought against the department of treasury um our website's the best resource but if you have like questions that you want specifically addressed you should feel free to email me peter coincinder.org i i don't mind just having an open inbox and i try to get to things quickly perfect thank you peter thank you for coming on again thanks rodrika