GitHub deleted accounts of people who contributed to Tornado Cash repos
twitter.com
twitter.com
- Phil Zimmerman (PGP) was under criminal investigation for arms exports by releasing the code for consumer encryption. The case escalated and was eventually dropped, included POTUS attention.
- Aaron Swartz passed away via suicide in 2013 under threat of 35 years in prison and a lot else for downloading from JSTOR programmatically
- Clifford Stole spent several years being ignored by every govt agency under the Sun, except for CIA, for finding, attributing and then exposing a widespread KGB hack of govt systems in the 80s
- L0pht testified in front of congress to expose significant internet security risks that were otherwise ignored.
I’m not saying Tornado Cash and related devs were doing a purely moral action. But the automatic siding with the heavy hand of govt sanctions on code the govt doesn’t really understand is pretty shameful for a nuanced technical audience.
You can disagree with the sanction while still being understanding of GitHub trying to cut ties with the sanctioned entity. Or be critical of them being heavy handed in their compliance but agree with the sanction in general.
Plenty of organizations in the past have chosen what side of this conceptual line to stand on.
One can end up looking like the EFF with a long term, very strong reputation of standing up for clear boundaries of what’s right in the legal<>code context and go to court over it, or you can end up looking like GitHub.
When you're a donation based non-profit, it's easy to "stand up for clear boundaries". In fact, it's literally your purpose.
When you've got >$100Bn of profits on the line, it's a little harder - and you have a different purpose (i.e. to make money).
Perhaps there is some grey area as to what qualifies as a service being provided to that entity. Is my fork still a service being provided to them? Or is it a service being provided to me? But that is still something useful to the sanctioned entity, so am I now providing them a service? In which case GitHub is still a party to providing them a service.
There's a massive difference between "nope, I won't comply with the law" and "I think this law is a bad idea, let's go to the courts to see if we can do something about it". And GitHub has done the last, too, to restore access to Iranian developers for example.
I don't agree with a lot of things in the world, but the only thing I wish for them is for things to get better, not worse.
The funny part is he's contributing to the problem, as in not realizing it's the working class vs the rich, not the left vs the right.
Edit - additionally, tornado runs on eth, which is soon to be env-friendly PoS.
Also, Ethereum has been "soon to be env-friendly PoS" for years now. Let's revisit that if and when it actually happens.
Bitcoin alone is estimated to use 150 terawatt-hours of electricity annually.
The US Department of Energy estimates that there are 80 million households with dishwashers in the US (although they believe 16m never use them, but we will ignore that). It appears that the average dishwasher uses 251kWh annually (at the avg of 215 cycles per year).
So this would put the US annual dishwasher power consumption to around 20 terawatt-hours. This would mean that the rest of the world would need approximately 518 million household dishwashers used 215 times a year each, to make up the rest of the power usage for just Bitcoin.
When you start factoring in the size difference in dishwashers between countries, the power usage differences between 120v and 220v in different parts of the world, the overall adoption rate of dishwashers etc... it makes it hard to believe that they could compete with crypto power usage.
The switch has been delayed 6(!) times since 2017. It‘s perpetually happening “soon”. I believe it when it’s actually live.
Seems like every celebrity and talk show host was pushing NFT's, be it Kardasians, Kimmel, Fallon, even Bill Murray released a collection 1 month ago. Ultra stars like Tom Brady to Mark Cuban were investing and (still) talking about crypto companies they are heavily invested in. Half the superbowl ads this year were advocating for people to waste money on crypto.
What is the name of this sanctioned entity that GitHub supposedly cut ties with?
You'll note that none of the developers who had their accounts suspended were themselves sanctioned.
As far as I know, Tornado Cash is not a legal entity either.
It seems like it's always been a tiny minority of idealists who put their own lives on the line to do what they believe is right in the face of the beast bearing down on them.
The majority has always been (and probably will always be) weak minded corporate yes men.
What is distasteful is the so called "hacker" community being filled with corporate yes men.
Also: GitHub is a private company. It's their real estate, they can do what they want with it. If they wanted to keep it up, they could have.
They didn't want to.
A legitimate example of free speech. Zimmerman published his code in the appendix of scholarly book, in addition to posting online in source & binary form.
> - Aaron Swartz passed away via suicide in 2013 under threat of 35 years in prison and a lot else for downloading from JSTOR programmatically
A terrible example, and not comparable to your first example. Swartz gained physical access to a network room he was not supposed to be, inside a building he was not supposed to be, connected a laptop to a LAN he was not granted access.... When you say programmatically, you must mean the parts where he proceeded to download JSTOR using his laptop? Has was criminally trespassing, accessing a network he knew he wasn't allowed to access. The tragic outcome was due to... hate to say it, he had well known mental issues that amplified the stress he felt when being indicted for a crime he knew he was guilty.
So I get what you're saying, but you might want to limit your examples to abjectly reasonable ones that withstand scrutiny. Otherwise it might look like a bandwagon, generalization, or even false dichotomy.
I remember those events clearly and even JSTOR, the "victim" in the case, backpedaled on the prosecution before he committed suicide. He was driven to suicide by an overzealous federal prosecutor trying to make a career for themselves.
[1] https://www.cnet.com/tech/tech-industry/swartz-didnt-face-pr...
Or, if you blame the prosecutor for driving him, do you also blame his friends and family for not being supportive enough?
Moreover, judges don’t care about prosecutors or what they think. And, sentences are largely determined by sentencing guidelines.
Rich white kids with no prior convictions don’t go to prison for stealing library books.
This doesn't mean that any/all measures taken against them are automatically justified, but it's large-scale crime, and it's not in the realm of "information wants to be free", it's actual money laundering, for actual criminal cartels and actual rogue states.
The automatic opposing of govt sanctions is pretty shameful for a nuanced technical audience.
But they do understand it, quite well. It launders money, there is no legal use for a money laundering machine.
No, this still isn’t a valid use.
Here's an analogy: Is it hypocritical to say "we shouldn't punish people who sell marijuana," but also say "we should punish people who sell heroin?"
Maybe you disagree with the person's preference for what should be punished, but saying "we should punish this behavior but not that behavior" doesn't make a person a hypocrite.
Would you stop the above chain of events at the very first link? Would you say: "We can't ban trojans because it's code, and code is speech, and speech is either free or its not?"
Is not a comment on free speech or not. There are rumors of government sanctions for this specific case, but the typical deplatforming is more like getting kicked out by the bouncer.
GitHub had to do this. It was required of them by law. Tornado was sanctioned.
> These prohibitions include the making of any contribution or provision of funds, goods, or services by, to, or for the benefit of any blocked person and the receipt of any contribution or provision of funds, goods, or services from any such person.
This is, unambiguously, directed toward entities such as GitHub providing them service.
I'm not a fan of GH these days but they did the only thing they could do in this situation. You can be upset about it, but you can't be upset at GitHub about it.
For what it’s worth, I don’t see much evidence of people being upset at GitHub in the thread. There’s talk about decentralized alternatives, but not much actual pinning the blame on them.
Imagine if, say, A foreign electronics company is sanctioned by the government - does this mean that anyone who has previously worked with them or bought their electronics has done so illegally? If so, that sounds like a significant impediment to commerce, since nobody can predict who will be sanctioned in the future.
This consideration would apply if and only if the government would actually pursue criminal charges against someone who contributed to TornadoCash - which they possibly would if someone would do stuff after these sanctions e.g. try to circumvent this GitHub block, make and advertise a replacement service, etc; do not do this if US laws apply to you.
I think your analysis is flawed. They didn't come up with some new law and apply it to these people ex post facto. These accounts were contributing to the money laundering (per accusations, albeit indirectly).
Another way to look at it: if these people were contributing knowingly to a project that was laundering money, should they be punished? Of course.
Everyone who has ever contributed to an open source project _could_ be (in the absence of the project setting up proper legal structures) considered a membership of a general partnership, and thereby become jointly and severally subject to unlimited liability for the actions of the partnership.
(IANAL this is just what I've read online)
That's not what's happening here. What you're seeing is a US company evaluating its ongoing business relationships, and making the decision that continuing to associate with principals of a designated company isn't worth any potential legal risk.
My understanding of the American justice system says you cannot do this, our founding fathers did not want any witch hunts, laws should deter future abuse, otherwise people might as well never do anything, ever.
Anyone contributing to Tornado after it became public knowledge that it was used to launder money put themselves at risk. The sanctions are the enforcement action. A wanted poster. The crime, laundering money, was committed a while ago.
> does this mean that anyone who has previously worked with them or bought their electronics has done so illegally?
If you knew they were doing sanctionable things, yes. If you didn’t, no.
I think this is probably an AUP question. The sanctions are a big enough "hey these users broke the law" signal.
We are talking about an entity that according to the treasury has laundered more than 7 Billion USD, assisted criminals and neglected complying to Anti-Money Laundering/Countering the Financing of Terrorism (AML/CFT) obligations willingly and repeatedly. Tornado Cash has repeatedly failed to impose effective controls designed to stop it from laundering funds for malicious cyber actors, regularly and without basic measures to address its risks.
This according to the treasury goes on for years since its creation, so everyone who actively contributed to the entity is considered a threat to national security and often, if you look at the sanctions list of OFAC sanctioned entities, rightfully so.
Retroactively, and to my knowledge, there is not a single investigation and OFAC sanction that got lifted by a court because the accusations themselves were wrong. And it's not like you don't have the right to appeal those sanctions. Entities and sanctioned people quite often do so, and fail.
See https://www.cadc.uscourts.gov/internet/judgments.nsf/C2B2FFF... for example.
Tornado Cash is not just a foreign electronics company that stumbled into an OFAC sanction because it accidentally sold a Toaster to Kim Jong-un, so he can enjoy a crispy morning toast.
Where you are right is, that OFAC sanctions are a significant impediment to commerce because you cannot predict who will be sanctioned in the future. That's why, as a company or even individual, you need to do due diligence on who you get in business with.
If you import fruits and someone gives you 5k per box of Avocados extra to import them from Mexico to the US asap, you can bet there are not just Avocados in those boxes. You can pretend you didn't know, but if you don't want to end up in jail for providing service to a cartel, you need to make sure there are only Avocados in those boxes and the premium is for extra fast shipping.
Everyone knows that virtual currency mixers are commonly used by illicit actors to launder funds, especially those stolen during significant heists. This is at least common knowledge since the Silk Road days.
So if you contribute to such a project, that has the potential to harm your fellow citizens and contribute to financing of terrorism, without making sure it is complying to Anti-Money Laundering/Countering the Financing of Terrorism (AML/CFT) obligations one hundred percent, you can't just cry foul play and say I didn't know anything of this. Especially if you understand code and the inner workings of said project or have a direct line to the people in charge if you frequently contribute.
So, in my opinion it's more than ok if everyone who contributed to Tornado Cash and enabling it to do what it is accused of, their life should turn to sh*t immediately and everything they touch from here on. Because getting people harmed or financing terrorism or foreign state actors is not a trivial offense. Laundering virtual currency for criminals hurts real people.
The IRS and bodies responsible for enforcing laws like those against "funding terror" (remember that?) certainly think that is crazy.
I'd say that this is a significant risk that people doing DeFi need to have a long, hard think about. Without a clear organization, without clear leadership, one cannot draw a bright line around those who deserve sanctioning. In court, efforts made towards plausible deniability might pay off. But github is not the courts, its interest is its own liability.
It looks like it was just the three creators. If they’re smart, this is a prelude to announcing a legal defence fund.
The other parts, like issue tracking, obviously are not.
They only had to block accounts that contributed after establishing the sanction. It's not clear that they limited themselves to those. It would in fact seem to be hard to contribute in the limited time range between establishing the sanction and removing the project.
There is also the collateral damage of removing unrelated projects that happened to be owned by these people. Couldn't github preserve such projects while putting them in some ownerless state?
The people who built Tornado Cash are already in trouble. The crime--facilitating money laundering--has already been committed. OFAC is an enforcement office. Its lists are more like wanted posters than rules.
GitHub is cutting ties with people likely to be charged with federal crimes. If some of them are going to continue contributing to the project, GitHub doesn't want to be the conduit through which it is done. This is all standard sanctions compliance.
Did the people who built blockchains with built-in mandatory mixing (Monero) or optional completely obscured transaction inputs (ZCash) also facilitate money laundering? If not, what is the crucial difference? Am I myself in trouble for having (co-)designed a mixing service [1]?
Probably not? Tornado Cash provided one service: mixing. (In AML parlance, layering.) We know it was used to launder the proceeds of crimes. The developers knew that too, and they kept working on it. Semenov styled himself as a co-founder and the group advertised open positions on its website. All that looks much more like an enterprise knowingly facilitating laundering than a developer publishing interesting code.
ZCash and Monero look like cash. Tornado (and every mixer I’ve seen) looks like a layering service. Those aren’t illegal per se. But you’re at risk if a criminal uses it. (You’re in deeper shit if it becomes known a criminal used it and you do nothing about it.)
So I guess what made Tornado Cash criminal, is that there was evidence of such...
Yes
>Am I myself in trouble for having (co-)designed a mixing service [1]?
Possibly? Depends on the details.
This is a far different standard. If we're talking about banning people because they seem like they might get charged with something, that's just a blacklist.
> If some of them are going to continue contributing to the project, GitHub doesn't want to be the conduit through which it is done.
That's why you delete the repositories. These are not sanctioned persons, this is a sanctioned project.
Edit: Unless it was members of the organization who had direct write access to the repos? Which I saw mentions of in other comments.
You'd think after 16 years I'd be used to it, but it still kinda blows my mind that the social network designed for context- and detail-free hot takes is the one people use for political discussion.
Having to explain yourself long form leads to people attacking you and often being correct.
Typically, people just take a paragraph or so of a long form political argument out of context and use it to call the person making the argument evil. Which is basically the same principle as the typical political attack ad where you take a sentence your opponent said out of context to make your opponent look like a crazy extremist.
With a short form discussion platform, you can just go straight to the personal attacks, name-calling and out of context distortions of the other side's beliefs. Then we wonder why we suddenly live in a country where the 2 political parties can't compromise on anything and where one of the top political priorities for both parties is prosecuting and jailing their political opponents. I think its very dangerous to view most political discussion being short form context free hot takes as either inevitable or healthy for a government based on free and fair elections (such a norm, however, is probably beneficial to the long term stability and security of a dictatorship). In a society with a democratically elected government, you need free, civil and respectful discussion of issues and a basic level of respect for those who disagree with you. Remove those things and democracy dies just like a plant dies if you deprive it of water and dirt.
Read the books “mindfucked” and “targeted” for the detail on Cambridge Analytica (actually Strategic Communications Laboratory or SCL group) how it was a cognitive warfare firm developed for counter terrorism which was unleashed on the American, British (and now presumably Brazilian, Italian and French public).
People are not polarized just due to social media - social media is now a cognitive warfare battleground where cognitive heuristics are the trenches.
Sanctioned project's contributors must be deleted from the server - where is that written in the list of things Microsoft has to do since you went out of your way calling everyone on the reply train ignorant?
This is quite simply not how a sanctions regime works. The US government does not make a list of all the sanctioned persons’ assets, then start going after those in court.
Instead, it goes the other way: any company with a US nexus watches those sanction lists carefully. When someone is listed they look at their internal records for hits and denies them service. So no one told Microsoft anything; they self-enforced a sanction that applies to everyone in the US. And I mean everyone: if an individual knowingly violates these sanctions they’re breaking federal law - it’s not just companies.
So when you contribute code to an open source project, you generally do so under an open source license. All of them generally contain something akin to the following:
IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE
LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
I can understand taking action against the people who run the code. I can even understand taking action against people who were hired to contribute. But why kick some random open source contributor in the guts? What did they do wrong?
Are there open source licenses that protect the contributors from such unforeseeable damage? Or are we to watch our step from now on as open source contributors?
The argument probably is that they assisted a sanctioned entity by providing a contribution i.e. service to it. Quoting US Treasury "These prohibitions include the making of any contribution or provision of funds, goods, or services by, to, or for the benefit of any blocked person and the receipt of any contribution or provision of funds, goods, or services from any such person."
However, the major factual question is whether they did violate any sanctions since the contributions generally were made before the sanctions were in effect - it's not that Github had to do it, but that they chose to be safe rather than sorry (in order to ensure that Github themselves don't violate the sanctions) and if they aren't absolutely sure they blocked people. [edit: apparently not everyone, some contributors are not blocked, so they apparently did some review before choosing whom to block]
The key issue is that any collateral damage is considered acceptable, but any false negatives are absolutely not. If Github leaves even one actual agent of TornadoCash unblocked, Github has committed a crime, if they block a hundred unrelated accounts, that doesn't violate anything.
> Are there open source licenses that protect the contributors from such unforeseeable damage?
No, a contract or license can't absolve you from this prohibition if it applies to you.
> Or are we to watch our step from now on as open source contributors?
Yes, but not "from now on" but since before open source existed. There are entities you are not allowed to contribute to, and it's your responsibility to know and check who you are dealing with.
But, you can’t just put anything in one of these agreements; the law overrides anything you might state in a contract.
Furthermore, software licenses govern the use of your code by other people. It doesn’t govern your use of the GitHub service.
Your use of GitHub is governed by the GitHub ToS. Under that agreement, they can terminate service for any reason they want. They can cancel your account if they wake up grumpy on a Tuesday and just feel like it. Or, they can terminate service because they don’t want to touch anything that might be sanctioned with a 10 foot pole.
From the Twitter thread it appears that the devs whose accounts were nuked were core contributors to a sanctioned entity. That feels fairly sensible & what a company who wants to comply with sanctions would do.
They wilfully contributed to the upkeep of a money laundering service. They should be thankful losing their GitHub account is the extent of the fallout, take it as a lesson that code can cause real harm, and act more judiciously in future when it comes to contributing labour to suspect projects.
If you are affected you could take this to court, and might even be able to convince them that the law went too far in incentivizing GitHub to delete your account. It seems very unlikely, but with a good lawyer courts can do weird things. If you do pull this off, then that would change court precedent, and when combined with a few dozen other cases eventually make it so courts will not accept deleting all accounts as a useful to to prove attempting to comply with the law. (Let me be clear, I doubt you could win this case, but it is theoretically possible so I offer it for completeness sake)
So you have to figure out for yourself if exercising your right to free speech is worth having the government blowup your life for the time it takes to “prove your innocence“. Because, I can assure you, they don’t care even a little bit about violating your constitutional rights if it gets in the way of whatever witch-hunt they are currently on. It’s the court’s job to sort those details out.
> Sanctions Implications
> These prohibitions include the making of any contribution or provision of funds, goods, or services by, to, or for the benefit of any blocked person and the receipt of any contribution or provision of funds, goods, or services from any such person.
One interesting and under-appreciated fact about OFAC: they take an, ahem, expansive view of where US law applies.
CSE TransTel was a company based in Singapore who was sanctioned in 2017[0]. They had a bank account with a Singapore bank. TransTel did business with Iran, in violation of US sanctions. But neither the company nor the bank were in the US; how did OFAC make that fly?
Because TransTel did transactions with a US dollar account, OFAC argued the settlements of that account caused banks inside the US to incidentally violate sanctions. Essentially the presence of US dollars created a nexus and allowed OFAC to enforce US sanctions against what would appear to be an entirely foreign entity.
Any wonder MS is treading lightly?
[0]: https://home.treasury.gov/system/files/126/20170727_transtel...
https://home.treasury.gov/policy-issues/financial-sanctions/...
https://home.treasury.gov/system/files/126/virtual_currency_...
This is just "deleting people because sanctions need to be severe and hurtful".
It's pretty cut and dry.
They'd no longer be allowed to contribute to the project, but does someone having contributed in the past mean the sanction on the project extends to their person? Github themselves provided hosting to the project.
Sanctions work because they are virulent.
I don't know but there are some comments asking for an distribute alternative to GitHub. That was pretty funny.
This makes no sense. They could have just blocked the Tornado project. Suspending individual accounts and contributors seems punitive. I was banned on github https://github.com/ransom1538 (unrelated) - it is pretty devastating. No recourse. Just gone. If something involves your lively hood (uber,grubhub,paypal,github, etc) you should be able to state your case.
Does anyone know if this sanction, "contribution or provision of funds, goods, or services by, to, or for...", applies also to individual human persons not associated with a corporate or institutional entity? Is there somewhere I can read about what sactions are, what they mean, and who they apply to?
If it's just a Microsoft problem and not a human person problem then the solutions are many and obvious for any tool that's useful. git itself is already pretty distributed friendly.
The people who wrote the code were not sanctioned. The repo hosting the code was not sanctioned.
GitHub did not have to do this. This is Microsoft's legal department and the concept of "an abundance of caution".
Nothing about hosting open source code is at issue here. Tornado (the smart contract) was financially sanctioned; it is still fine to host source code.
I think it's the culture of reacting to 240 characters or less. People already know what they want to feel and finding a quick and completely baseless confirmation bias on twitter is easy and rewards you greatly with dopamine.
Smart, mature people gather information before making a decision. Dumb people knee-jerk react based on low information. Twitter heavily encourages the latter by making the former very difficult to do.
> TORNADO CASH (a.k.a. TORNADO CASH CLASSIC; a.k.a. TORNADO CASH NOVA);
> Website tornado.cash;
Note that hosting code and free developer accounts does not require GitHub to accept or pay money to the developers (who are not named explicitly in the sanctions order, by the way.)
ETA: Big tech companies have a lot of resources and freedom to devote those resources to defending their users (see Google and Twitter lawsuits.) But they’re self-interested and won’t do that if they think their user-base won’t hold them responsible for doing that. I think GitHub is responsible here and I wish the HN commentariat would recognize that their opinion matters. By excusing the company’s cowardice here, we are incentivizing more of it in the future.
The nicest way i'd choose to describe the people of twitter.
You just gave the best 3-sentence argument for not using GitHub.
Given how capricious US government has become, it's unreasonable to host your code in Github.
Can't repeat that often enough. No matter how much I think I have internalized this, it is a continuing lesson.
This is why I'm surprised more people aren't way more terrified about OFAC than there are. It's probably one of the nastiest diplomatic tools the U.S. has in its arsenal.
https://en.wikipedia.org/wiki/Junger_v._Daley https://en.wikipedia.org/wiki/Bernstein_v._United_States
After reading them carefully I think my earlier statement is correct - there is no law which considers source code as free speech, and several legal frameworks which actively oppose the idea (ITAR, IP and copyright, etc). The idea seems pretty silly to me.
IP and copyright do apply to (otherwise free) speech. That's the whole point of them. The Supreme Court famously called copyright 'an engine of free expression'.
Code is fundamentally ideas, explanations, instructions on how to calculate something, written down in rigid, formalized language. I don't see how it couldn't be a form of "speech", just like books, poems and music are.
Speech is regulated of course, e.g. bomb-building instructions are illegal to publish in the US.
Maybe you could make a case this crypto shuffling method is similar and spreading the know-how on how to do it should be forbidden, but that doesn't make it not speech.
> No, it is not.
> That's a pretty uncharitable interpretation.
I get that contributing to the repos would be a violation of the sanctions, but it's not clear to me when the project was sanctioned and whether all the contributors were aware that they were contributing to a sanctioned project. Would it have been enough for GitHub just to remove the projects?
I ask as someone who has a lot of developer friends from Cuba who run into problems with accounts on platforms being deleted all the time. IIRC there was an episode awhile ago when accounts were being deleted simply for logging in from Cuba.
It seems like the legal obligation would be to block logins from Cuba (and/or Cuban people), but deletion of accounts seems more like a CYA move than a strict obligation.
> deletion of accounts seems more like a CYA move than a strict obligation.
Microsoft is prohibited from giving any good or service to a blocked entity. It’s very possible their lawyers will say “the easiest way to meet this obligation is to delete accounts related to the blocked entity.”
The legal system is CYA, after all.
Tornado Cash is on the SDN list [1].
From [2]:
> Business transactions of any sort with SDNs are expressly prohibited and U.S. persons must block any property in their possession or under their control in which an SDN has an interest.
IANAL but it doesn't sound like much of a leap to say using GitHub falls within "business transactions of any sort".
Clarification question: Did GitHub delete the accounts of anyone who contributed to the repos? My guess would be owners and maintainers? Officially, Tornado Cash, the entity, is what's on the list, so I would think at the very least anyone who is formally tied to the entity.
[1]: https://home.treasury.gov/policy-issues/financial-sanctions/...
[2]: https://www.visualofac.com/resources/sanctions-and-embargoes...
But it is deeply concerning. Whether or not you like crypto, you should not be supporting this if you are a researcher, academic, technologist, cryptographer, or privacy advocate. The code for Tornado Cash is a series of cryptographic and mathematical functions that can be repurposed for a variety of applications unrelated to privatizing user wallets.
Having it open source and accessible is a net benefit for the entire world.
EDIT: A comparison would be that US decides to sanction the open Matrix protocol and any developer that has contributed to it, as it can facilitate end-to-end encrypted terrorist communication.
If you want to run git for free, run it on your own computer.
There’s definitely no moral obligation for someone to do the same at risk of prison time.
They do have a moral obligation to follow the laws of the country they operate in, though.
This is open huge so many terrible ways for abuse.
1. Make some random crypto project.
2. Motivate people contribute to it, see DigitalOcean hacktoberfest.
3. Replace the code with Tornado.Cash source.
Can skip this step. Just make fake commits (https://github.com/asizikov/gang/graphs/contributors).
Code is speech, that's settled law. It's the entity and wallets that are sanctioned. If someone is a member of the Tornado Cash group on GitHub, it’s safe to say they’re in at least legal jeopardy. GitHub puts itself at risk by knowingly continuing to facilitate their work.
Problem is that Microsoft is certainly overreaching here and this precedent will be abused by malicious actors. One day someone will come to work and find out that whole organization was banned on github just by forging to commits.
But this is definitely a bit of a stretch to go after the creator(s) in this way. Reminds me of the US Gov trying to ban/limit all encryption. Didn't seem okay then and this doesn't seem okay now.
I’m not at all pro crypto but this enforcement does seem extreme. I do understand that Microsoft is just following the sanctions.
We can argue about the legit/legal uses of Tornado Cash and whether it deserves to be sanctioned - but do so in good faith rather than pretending like it is equivalent to a general purpose tool like Microsoft Windows.
I do however have an issue with the incredibly high rate of money laundering etc that flows through crypto. Particularly so with Tornado cash. It's the 'go-to' for easy money laundering.
And no that's not a 'general ignorance' it's just a bi-product of having decentralized systems, it's not for me. That doesn't mean people are ignorant of it.
Edit: It really irks me this "oh you just don't get it" from some people. It's unproductive and from my own experience, incorrect. They give crypto supporters a bad name.
If it were money laundering, you would be able to purchase a house with the money you made from drugs and then mixed through tornado. You can't. It's indistinct from having cash you made from selling drugs.
You still need to create a fake business to launder your money the old fashioned way if you want to have a legitimate origin for your money. Tornado does not launder your money. Claiming the origin of your money is tornado and nothing else is akin to claiming the origin of your money is cash you found on the street or something.
Tornado is just an anonymity tool.
If I deposit 200k USD into my bank account which came from Tornado.cash - They will ask for proof it came from there.
Tornado cash will confirm this with their compliance tools etc. However as to where it came from before is in practice today impossible to identify.
The bank // IRS whoever may suspect something bad, but unless they can prove it, and I pay taxes on it, then that money is considered clean.
All one would need to say is - I lost my original wallet(s) when I slowly dripped it from a few old accounts I had when I was mining back in the day into Tornado.
I'm sure there are other clever ways cretins will come up with too but thats just off the top of my head. A very effective annonomizing tool helps that.
I'm not condoning it, I just don't think you should be too naive to believe its not happening.
Incredibly high relative to what exactly? The total exchange volume of the cryptocurrency industry? Can you show some figures to back that assertion? OR are you talking relative to the global economy? In that case, it's not even a drop in the bucket.
Clearly the Tornado Cash team should have simply started a bank instead, then they would only need pay a fine and carry on.
You should know comparing traditional fiat against crypto doesn't make sense.. But I guess I'm the one who's ignorant.
There is a good paper overviewing a lot here : https://www.unive.it/pag/fileadmin/user_upload/dipartimenti/...
It's more of an essay but all all stats are referenced.
Also another good read : https://ciphertrace.com/q3-2018-cryptocurrency-anti-money-la...
You simply can't argue that money laundering isn't rampant on cypto currencies.
Also just another clarification from your earlier comment :
> Your vitriol against Tornado is misplaced, though not surprising given the general ignorance regarding the blockchain industry on HN.
Blockchain != Crypto
>GitHub suspends Tornado Cash developer account
https://news.ycombinator.com/item?id=32389706
>U.S. Treasury sanctions virtual currency mixer Tornado Cash
The target here is a software package, essentially speech so, one step down That hill.
At least congress isn't deluded, corrupt, and senile enough to try this.
Edit: further, it seems they're going to have to shut down Ethereum too, because Tornado Cash's contract is a person, and subgroup of Ethereum under the definition of entity which falls under the definition of person. [1]
Apparently Treasury is also accusing this tiny piece of code of being engaged in activities that form "... a significant threat to the national security, foreign policy, or economic health or financial stability ..."
[1]: https://obamawhitehouse.archives.gov/the-press-office/2015/0...
I don't believe that EO is related to this case. These are OFAC sanctions against the entity Tornado Cash and its related ETH addresses. A US person or Entity cannot interact with them any more. But that does not sanction the entire ETH network. That would be like shutting down an entire bank, or the entire banking network, because a couple accounts were sanctioned. That's not what happens.
Or are you more concerned with additional sanctions against the entire ETH network coming in the future?
But no software is performing any action; A system running said software could, but the software by itself cannot.
And regarding a system performing actions: didn't the USPTO similarly declare that an AI (=software system) can never be qualified as an inventor, because it has no agency?
To rephrase, since Ethereum network, which is an person in the context of the EO, facilitates Tornado Cash's contract, it is "complicit" with the activities as well.
EO 13694 was amended by EO 13757. [1] And section 1.a.ii reads: "any person determined by the Secretary of the Treasury, in consultation with the Attorney General and the Secretary of State, to be responsible for or complicit in..." and 1.a.iii has similar wording.
It requires the Treasury and Attorney General to make a determination on the entities being sanctioned. It does not expand the sanctions beyond the entities that are named. So as it stands I can't see how it would require shutting down the ETH network. Sanctioning a sub group does not mean the sanction applies to the parent group. The sanction means US entities cannot interact with the named entities and nothing more. It does not apply to any parent groups and it does not mean other non US entities cannot interact with it. And I don't think the ETH network would count as a US entity.
If the argument is that they could further sanction the entire ETH network, then I suppose they could do that. But that isn't what this sanction does.
[1] https://home.treasury.gov/system/files/126/E.O.%2013694%2C%2...
However it is clean that we, the programmer community, needs some way to stop projects from being sanctioned (as opposed to companies or specific persons). One obvious way would be to amend open source licenses to not permit them to be used by the US government if it attacks any other project in that group or something similar.
I am sure something better could come up, but we have lots of power if we were willing to come together and use it.
it isn't. the sheep have been bleating "corporations can do whatever they want" for 10 years now. the pigs will be fine.
guess only rich insiders are allowed to launder money.
Are we going to prosecute people who manufacture phosphor bombs for the US military as well now?
The distinction is important, but seems to have been lost somewhere along the way.
I don't think I'd describe that as "generally illegal" since it leaves a heck of a lot of situations where it is legal to use it.
Tornado is sanctioned, not the underlying code. Contributing to the project is legally tantamount to coding for a North Korean entity. This isn’t a start to anything, it’s established law and practice.
Simply pulling shouldn't be a problem. But I can see law enforcement getting a subpoena for a list of accounts that pulled that repo to find and stop copycats.
And speaking of code - North Korea has their own os which is essentially a reskinned version of Linux. Does that mean that the US government could go after people who contributed to the Linux project?
No. You’re comparing money laundering, which has stricter controls, to exporting software, which doesn’t. (If you knowingly provide support to Pyongyang, probably.)
Edit: Spelling of scapegoat
And since creating more than one acc is against Github ToS, the best move is to stop using it ASAP except if required for work.
Not that it's very functional, but it exists
Are they entirely unaware of git's default decentralized nature, or even that there are other central repository sites?
If the US government put pressure on Github to remove the code and delete their accounts, it seems like a clear violation of the developer's first amendment rights – "code is speech" being precedent.
GitHub has a section on this[1]. There should be no problem with allowing this software online for research and educational purposes.
[1] https://docs.github.com/en/site-policy/acceptable-use-polici...
also consider applications that might be illegal but often considered moral like paying for an abortion with tornado cash ETH in a state where abortion is illegal, or donating to a state that your current regime is at war with.
Here it is less about the code as speech, but code as an illegal business and product. It's not an either//or situation. Code is more than just one thing.
crypto wars 2.0
edit: I believe the term is "criminal facilitation."
GitHub are no longer legally able to provide the service, and so those people no longer have access to GitHub the service. Nothing code-related.
> After four years and one regulatory change, the Ninth Circuit Court of Appeals ruled that software source code was speech protected by the First Amendment and that the government's regulations preventing its publication were unconstitutional.
https://www.cnn.com/2022/06/06/us/california-bees-fish-court...
https://www.courthousenews.com/carrying-guns-in-public-is-no...
https://reason.com/2022/01/26/a-federal-judges-satirical-opi...
You'll understand if what the 9th Circuit declares has lost a touch of automatic deference from an intellectual, rational consistency, and linguistic abuse point of view, I hope.
[1]: https://www.aljazeera.com/news/2022/8/8/us-announces-sanctio...
+1 disambiguation needed
CC @dang
I wish typing "cc @dang" did something, but to the best of my knowledge it does not / isn't monitored vs email.
But really did anyone really expect working on a money laundering project would be a good idea? Sure it was a new method of money laundering but it’s pretty obviously money laundering