Republishing a fork of the sanctioned Tornado Cash repositories
twitter.com
twitter.com
https://www.eff.org/deeplinks/2022/08/code-speech-and-tornad...
> In keeping with our longstanding defense of the right to publish code, we are representing Professor Matthew Green, who teaches computer science at the Johns Hopkins Information Security Institute, including applied cryptography and anonymous cryptocurrencies. Part of his work involves studying and improving privacy-enhancing technologies, and teaching his students about mixers like Tornado Cash. The disappearance of Tornado Cash’s repository from GitHub created a gap in the available information on mixer technology, so Professor Green made a fork of the code, and posted the replica so it would be available for study. The First Amendment protects both GitHub’s right to host that code, and Professor Green’s right to publish (here republish) it on GitHub so he and others can use it for teaching, for further study, and for development of the technology.
If he does not, then he is not a participating entity in the sanctioned service, and is unlikely to attract serious attention from the Justice Department.
It’s nice of the EFF to throw down a gauntlet about free speech, but I expect it will be ignored in favor of sanctioning others who operate cryptohash laundering services.
This is well beyond the regulatory and legal powers of the U.S. Treasury and the DOJ. That is not the letter of the law with regards to money laundering, and the agency cannot invent new laws out of thin air. Nor can they blanket ban a technology or code just because they have to learn new stuff. Could Congress pass such a law? Sure, but even then, we'll go to the mats in the court and in state legislatures. Nevermind that criminalizing and demonizing a large portion of the population hurts your re-election chances.
Even torrenting, as egregious as the copyright abuse was in Pirate Bay's heyday, was never banned in such a way. Email scams from Nigeria never necessitated the shutdown of email. VPNs continue to operate.
Nevermind that similar cases with regards to cryptography have already gone to court, which ruled in favor of speech: https://www.eff.org/deeplinks/2015/04/remembering-case-estab...
The XKCD example is amusing, but fails even the most basic cross-examination. Surely officers with a court-issued warrant for probable cause of a crime should be able to inspect a person's home or things. Maybe they could find a private key written on a post-it note somewhere in the person's home. That's all fair and good, and no one is arguing against that. Clearly, it's not very scalable, nor should it be. We operate under the presumption of innocence in free societies.
We all have a problem with illegal, abusive, mass surveillance. It is a violation of human liberty and a disturbing trend that has to be pushed against to prevent a full-on dystopian, authoritarian hellscape where you don't even have paper cash as an outlet from the panopticon. To avoid that future outcome, to preserve the freedom of your children, you have to fight for privacy and transactional liberty. My ancestors were willing to bleed and die for liberty. Some of us still are, today. Never wake a sleeping lion, indeed.
However, I observe with these sanctions that both the US judiciary and those of many others countries has decided cryptocoin laundering is not a protected human right, due to the balance of harm caused to societies outweighing the rights of the individual. It’s your right here in the US to declare that they’re wrong, but I do not see in your reply any new evidence or arguments presented that would change the course of the US government.
> If the ether is proceeds from a crime, then this is literally just money laundering.
> There’s also this weird delusion that if you put some dirty money in a box with clean money and shake it, then it all comes out as clean — and not that it all comes out as dirty.
> The bad takes were all variations of the fundamental fallacy of cryptocurrency: that you can code your way around the rules of society.
1: https://davidgerard.co.uk/blockchain/2022/08/09/us-sanctions...
That's the exact take that brought to closure of tornado.cash. If you start with two distinct piles and at the end you only get one some-of-these-might-be-dirty pile, the solution to this is to destroy the mixer, not to sift through bank notes. The reason why we don't consider everything that has touched dirty money to be tainted is explicitly to protect people who may have been inadvertently brought into it.
Touching the tornado cash contract is a poison pill right now.
gitlab isn't bought and paid for, so forcing the issue only stands to win them PR with hackers.
You seem to be under the impression that "the government" is a monolitic beast that all operates together.
There are other parts of government that would like nothing more than to see OFAC get a bloody nose over this (eg, other agencies that believe they should be the ones regulating crypto).
He republished it on GitHub: https://github.com/tornado-repositories
Even more generally, governments ruled by laws do not care in the sense that they do not, as a system, carry grudges and the like. A government contract is awarded by tender, for which there are rules. And unless you have exactly the same people handling two issues, there's just no mechanism for any interest to bend the rules to be transmitted from one group of people to the other.
There are sometimes cracks in this system, but even those are somewhat formalized: "buy American" rules, for example. There are also rules that apply to government contractors but not businesses operating in the private sector exclusively, such as higher minimum wages, enhanced environmental protection, or union requirements. The reason here is that these can be instituted by the executive alone, without the legislative.
But punishing a single company just because they're taking an issue to court? That'd be consider rather corrupt. It's also silly: there are thousands of lawsuits between governments and private businesses every year. Every single Fortune 500 is probably involved in a few dozens at any given time.
> The first may protect the right for Github to host the repo (though even that seems somewhat a stretch)
There's a rather murky limit on freedom of speech, I'm really not sure where it stands with regard to instructional content in general - however some such content has been constrained before; usually regarding weapons (or really any content that the government can argue is weapons related).
It's murky, and subject to government overreach.
> but it certainly doesn't grant or protect any right to publish on Github servers.
The first constrains the government, it in no way constrains private entities.
In fact (given the corporate personhood), to require that a private entity publish content from a third party would be compelled speech, and a breach of the entity's first amendment rights.
I don't believe it's murky at all, but defined deliberately in fuzzy terms in a number of important ways, one of which is the avoidance of precipitation of criminality. Criminality defined as that which is harmful to society. Although it may sound weak, compared to the presumed unfettered principles invoked above, should one or other of a separating couple used Tornado Cash to rinse common property funds, something that isn't drug dealing or terrorism anyhow, nevertheless it's laundering and using a device to commit a crime without which device that crime may not be possible. Federal proceedings against Tornado Cash have given the unlawful enterprise unprecedented profile and it follows that the motivation for anyone who strives for continuance of the same or similar, in light of the reasons for federal action, could be construed as being potential criminal too. Frankly I am stunned in the era that recognizes hate speech, that the automatic right to unfiltered and inconsequential freedom of speech is claimed so crudely, so reflexively and on such narrow and unexplained grounds..
Common misconception.
You can post the machinist drawings for any unclassified (or classified, if somehow you came across them without having signed any paperwork related to security clearances). That is protected by the Courts.
Where you get into hot water is ITAR and restricted exports where free speech runs into the whole national security/foreign affairs jurisdiction by the Feds. You cannot post the manual for an F-16 for instance, in such a way as it could be accessed by adversaries of the United States. Access to that type of information has to be gated behind some form of arcane onboarding process to ensure one is actually authorized to see it.
There was an attempt at gating 3d printed gun patterns I think, but all the courts would let through is that a manufacturer must ensure the recipient is a U.S. Citizen, so it switched from published on website, to shipped on CD iirc.
Haven't checked on recent developments.
The first part's maybe true, the second part is bullshit.
Microsoft just did some risk management and decided that it's not worth it to keep their own users data. I find it quite interesting that someone puts Github's management in a difficult situation. Are they gonna terminate Prof Green's account too? Are they gonna hunt down every copy of the source code on Github? Are they giving high-profile users a special treatment?
Looking forward to how this plays out.
Even if some activist executive would allow it, Microsoft’s lawyers would absolutely not.
And the shareholders also wouldn’t.
Don’t forget that the purpose of a business is to create shareholder value (as defined by the shareholders themselves), and I highly doubt that the majority of Microsoft’s shareholders would see any value in this. Just liability.
Conclusion - not worth it.
> Are they gonna terminate Prof Green's account too?
Probably not.
> Are they gonna hunt down every copy of the source code on Github?
Probably.
It's a perversion of the concept to jump to must produce a positive financial return. Sometimes you just need an organization to coordinate something that eases a societal ill.
That business schools have forgotten this, and that we don't remind people of this consistently is a tragedy. It cuts off entire avenues of collective organization to get things done. Some times "getting it done at minimum outlay" is enough.
At no point I suggested that. I said "shareholder value, as defined by the shareholders themselves".
"value" doesn't imply fiscal.
Why do some people jump to interpret things that way? There's something kind of pathetic at the heart of that.
Is government the reason GitHub is removing the repo?
If so, then this is exactly an abridgment of rights, and GitHub would be an accomplice to the government is that violation. Government asking for someone's rights to be violiated, no matter how politely they do so, is still a violation of rights.
Absolutely nobody will admit to the dynamic and will actively avoid any attempt at on paper recognition of it, as to do so will completely destroy/dismantle the PD chain.
In short, the government is effectively accountabilty laundering in order to for keep out money launderers.
Is how I read it.
Yeah it proyects it against the government. Everybody else is still free to sue, take down, deny access, whatever.
Republicans would say "hell no it's our sovereignty", Democrats "maybe", the American courts: "maybe but probably not"
Never. Or immediately, depending on your perspective. Either way, there’s no need for further paperwork.
> Treaties to which the United States is a party also have the force of federal legislation […]
— https://www.senate.gov/about/powers-procedures/treaties.htm
If this professor is unconnected to the sanctioned Tornado Cash service, then Github shouldn't have to worry about running afoul of the sanctions by hosting the code.
The Tornado Cash sanction has been fascinating to watch and my key takeaway has been that there are two camps: that TC is a Money Laundering service or a Privacy service. Both are talking past each other, when it can in fact be both. Each camp see the service as their primary concern and consider the other camp as an unintended secondary.
I am seeing a lot of bad takes. "Money laundering requires all three aspects" particularly irks me because you can just point to KYC regulations to disprove that. "Code is just code" is another, but that is just because the code isn't why someone would be sanctioned or arrested. In the same way that The Pirate Bay was just code, its is how complicit they were in the offence that will get them.
Ultimately, the dichotomy feels like a problem unique to public blockchains, and will only be solved with a ZK L1 chain, whatever that looks like. The solution would require the blockchain equivalent of end-to-end encryption, one where intermediaries have zero knowledge but doesn't require co-mingling of dirty and clean money.
While I think money laundering is a more serious crime than piracy (at least the predicate offenses can be). Watch this play out like Megaupload, never ending legal issues for the first parties, and a technical solution like Mega.
How would you draft a statutory safe harbor for GitHubs and Coinbases when it comes to handling mixers as well as the wallets connected to them?
I have mixed thoughts on safe harbor for centralised exchanges, they are the closest thing we have to banks in cryptoland. Mostly because with grey areas like that, a prosecution is only going to be pursued with clear evidence they knew but did nothing.
KYC-plus: provided that they can prove somehow that their mixer is not handling money for sanctioned entities, they can be left alone.
Can you explain what you mean by this? To me, publishing code that can be used to do something is very different from running it and allowing people to use it.
My meaning of "code is just code" as a bad take, was just that the code part in isolation wasn't sanctioned.
that difference is non-existent when code is published as a smart contract
What are the aspects?
Note that the TC smart contracts are completely autonomous now (no entity with privileged permission or receiving a fee). They are truly non-custodial and necessary functionality is either executing on-chain or locally on the client.
So a user can make full use of tornado cash suite (smart contracts + UI) without ever having to interact with or pay a fee to anyone involved in the project.
Now, if a user withdraws manually, they will still need to submit a withdraw transaction and pay some ETH for gas (transaction cost), which will link that ETH with the withdrawn funds. So there is a chicken-and-egg problem here. To solve this, the UI integrates with a network of relayers who will facilitate the withdrawal transaction and cover the gas for a percentage fee. Relayers aren't hardcoded in the UI or smart contract and users can choose their own third-party relayer. The relayer network is permissionless and autonomous as well - anyone who sets up the software and commits enough funds will be one. In newer versions of the TC UI, only relayer nodes which have staked a minimal amount of TORN tokens are showed for selection, and there is a ranking and preference of relayers who have higher amounts staked.
This relaying, on the other hand, can absolutely be seen as a service. There could be a case for ML to have against that network of relayers. And potentially (though this is new territory for courts I think) TORN token holders and/or governance participants. This clear separation between the components and stakeholders and the removal of the need of privileged actors is precisely what makes TornadoCash different from legacy mixers.
I think it's very unfortunate that even people in the space characterize this TC as such as a "service", as I think it's best viewed as "not a service" - to this point, there are no service providers apart from the serving of the self-hostable client web UI. Which is optional. It's hard to tell in which cases this is a conscious oversimplification and in which cases people aren't aware of the nuance.
If I'm allowed to make a rough comparison from the best of my understanding to Bittorrent for those who remember the TPB saga:
Ethereum nodes: Bittorrent DHT
Tornado Cash UI: Bittorrent client in a web UI
Tornado Cash smart contracts: software executing in the "DHT" (by every node)
Relayer server-side API (old UI): Bittorrent tracker
TORN DAO smart contract (new UI): Bittorrent tracker, except there's no server anymore and it all executes in the DHT
> Person that has worked on the defensive side of Money Laundering here.
Would love to have a follow-up from you with thoughts on the above.
We could get lost in the technical details of why it is or isn't a service but ultimately they only need to prove that x person of the project knew about the issues, could have done something about it (like shut it down), and didn't do enough.
It was just the one contract wasn't it? i.e. someone was responsible for deploying the contract that inputs and outputs the blending between addresses. In this scenario, the other permission less stuff is theatre.
The people who did deploy the contracts did it out of the goodness of their hearts? that seems..odd.
Plus the initial developers could run relay nodes to make money, and can even do it in a way that is basically impossible to prove, by using TC itself when withdrawing the profits made by their relay nodes. Back before sanctions, even at a centralized exchange, nobody would think anything is odd about TC developers exchanging out coins previously transferred through the TC system. After all they care about privacy and don't want people to be able to trace back to all their previous transactions.
Like monero?
But then either only ever use Monero for everything (like pre-2013 bitcoin), or exchanges will need the will to "proof" the source of funds aren't illicit.
Is there any cryptocurrency Blockchain (or research) that can limit the amount of currency held by each natural person (e.g. to an equivalent of roughly 10000 USD purchasing power) while providing anonymity for individual transactions to the outside? I would actually be willing to adopt such a trade-off roughly equivalent to cash (even paying transaction fees). At the moment I would not use crypto currencies because I do not feel that I share the values of the block chains.
otherwise nobody else knows what you are talking about and it just reads like strawman arguments to discredit something nobody here actually said.
The issues are that the order does not distinguish between an un/incorporated organization of humans called Tornado Cash, and the autonomous smart contract that those humans do not control. The autonomous smart contract has no way of petitioning to removing itself from the SDN list, which is a prerequisite for inclusion in the SDN list, and a prerequisite for an American to get a license or have any remedy under the Administrative Procedures Act. Another division of the Treasury, FinCEN already has knowledge on this distinction and has said it in the past, while the OFAC division is acting like it is not aware of that guidance at all. There are other issues with that.
The follow-on issues are that this creates a chilling effect on speech and expression. Nobody knows their liability surface, and alters their own behavior because they aren't sure if they're going to prison or not.
I totally concur to your view. The issue would be the level of complicity in the offense of TC hosts... which will not be studied in theory by analysts studying the code, but by investigators looking at mails, meetings, money, interviewing people, etc.
Tech bros tend to forget that there are real people on the side of Law enforcement and that they can actually investigate in a very real and traditional manner, with surprisingly good results.
how would that be different from tornado? There's no legal difference between a contract with a balance and an internal utxo tree, and a blockchain with a total balance and an internal utxo tree.
As long as 1% of miners include TC transactions, even if 99% choose to not include, TC transactions will still be part of the blockchain, albeit not as timely.
When miners start actively REFUSING to build on blocks that feature TC problems, that is an issue.
For what it's worth, the ethereum development community is actively exploring features that make active censorship a network violation (with censored blocks not being accepted by the network), although this is an area of active research.
Current proposals include PBS+crList.
It’s an interesting area…
Firstly, miners do not technically intermediate transactions. Transactions are fixed and sealed by the parties involved and can't be modified. Transferred funds are never in a possession of a miner, not even briefly. Miner can't take them, can't redirect them, can't change the amount, etc.
Secondly, it's not a specific miner that confirms the transaction. It is the ever-growing group of miners. Transaction finality is ever only probabilistic. If you think picking by law the "first" miner then this is completely arbitrary and 1-block chain tips are routinely orphaned in all cryptocurrencies.
Finally, many persons and businesses accept unconfirmed (not mined) transactions, for relatively low-risk goods and services.
If you really want to regulate miners (which is making a crime running certain algorithms on your personal computer - a terrible idea), then at least please come up with a new name and new framework, because "money transmitter" or "financial intermediary" is simply incorrect.
There have to be some limits to how big of a burden the government can put on people in the name of stopping money laundering, the current AML model has huge costs, in financial terms but also in terms of the invasion of privacy - if you've ever had to pass a more stringent AML check, you know how invasive and dehumanizing that is.
And it's not even working, estimates put the effectiveness of the current AML regime at less than 1% of money laundering being detected.
Stopping crimes should be the job of the police.
Specifically, it seems dumb to continue the idea of "github is where all the code is."
The code being published is not at issue.
Maybe we need to print some books with the code inside a-la PGP (ISBN 0-262-24039-4)
In my opinion an unenforceable law is detrimental and erodes the credibility of the authorities that impose such restrictions.
Now whether it is an overreach is an interesting discussion, but do not for one second think that it cannot be enforced. Right now it is just a choice that just this particular service was targeted.
And note how most reasonable people would hesitate to just click a link to that code.. when it is not even the sanctioned TC. The chilling effect alone makes it enforceable.
That said, I am always eager to learn. Would you be willing to share trivial steps that keep your identity separated?
KYC information can be added long after you've made the transaction.
It’s similarly trivial to hide cash income. I assume keeping this identity separate would also extend to tax fraud, so I guess we’re there in the conversation.
There is quite literally zero reason to suspect tax evasion from somebody just because they want their identity to remain detached from the products they purchase.
Criminals who use cryptocurrencies are identified all the time.
just to name a couple of ways you can obtain crypto with absolute guarantees your wallet can't be attached to your identity. (provided you don't leak metadata thru other means such as simply telling someone your wallet address)
But criminals do more things than just holding crypto in a wallet. And it's those other things that burn them: Interactions with other people, being subject to search and seizure, transacting for other assets, or committing crimes.
At the end of the day, what point is there in being a criminal if you never spend your money?
Again, this is achievable in many different ways. Today, anybody with a trivial amount of knowledge on basic feature sets of various coins can do this.
You can't link me to the coins I earn via mining, you can't link me to the coins I spent on some other private chain (e.g. monero) and thus when I buy starbucks with a wallet, quite literally only starbucks will know that I had enough funds in a wallet to pay for a coffee and unless starbucks goes KYC then they also won't have metadata linking my identity to that purchase anymore than if I had used cash.
1. Someone can physically observe you
2. Someone can observe the surveillance camera footage
3. Your device may be compromised
4. The network you are using may be compromised
5. Starbucks may divulge that transaction to others
6. Someone may compel Starbucks to divulge the information
7. Someone may physically steal your private keys while in the Starbucks
8. You might tell the barista your real name
Etc.
Now Starbucks is perfectly legal and nobody cares that you bought a coffee, so nobody does this. But if it were $50m worth of illegal drugs, someone may assign some resources to doing so.
Anyone who engages in crime for profit is inherently interacting with other people, and eventually, hoping to turn those tokens into physical wealth.
Crypto isn’t the first pseudoanonymous currency. The way you catch a drug dealer that uses monero is exactly the same way you catch one that uses cash.
In my opinion? Greed. Cryptocurrencies were supposed to be all about creating a type of money that doesn't depend on a central authority. And then the last 10 years were spent trying to exchange them for dollars, which of course depend on a central authority. "We will be finally free from banks" turned into "banks are being mean and they won't work with us".
https://en.wikipedia.org/wiki/Pretty_Good_Privacy#Criminal_i...
For the same reason it doesn’t cover the ones and zeroes in a bank’s records.
They are worried about when the code runs.
(btw, I've deliberately outlined a protocol that doesn't rely on other third-party resources - if you're happy to rely eg on Etherscan you can do a simple diff against the original code)
Green's claim is related.
"Github is a private corporation and has no obligation to host anything." is not true when Github is acting as a US govt agent.
Disclosure, if this gets past the motion to dismiss, will be interesting.
A better way instead, would be to do what all other projects like GNOME, KDE, Tor, wireguard, etc have done before and that is to just self-host the repositories instead.
Github complies to sanctions by removing all repositories owned by sanctioned organization. Doesn’t mean you can’t have a copy of their code.
Freedom of speech protects you from your government. It does not guarantee you a platform.
In the US, the 1st amendment prohibits the US government from infringing on a persons natural right to free speech.
"Freedom of speech" is not a law, or provision. Pointing out that a platform "has the right" to violate peoples freedom of speech (and yes it is an infringement of the principle) is both obvious and pointless. People that actually support the principle also have the right to express their deep disappointment that GH would abuse their position of power, abuse the privilege bestowed upon them by the community of open source developers by cowering to the US government and refusing to stand up for the principle of Free speech
First Amendment is the application of the principal of free speech to law
However freedom of speech is also a larger principal then just the first amendment. People seem to only want to focus on the first amendment and government censorship as if that is the only type of censorship
This seems to be a core misunderstanding of people on this thread.
My understanding is that GitHub voluntarily took down the repo, which is a no-brainer from a business perspective and well within their rights.
> I’ve worked with this code as a researcher and I use it to teach my classes, so it’s important to me that it stays easily-accessible on a major site like GitHub. (This is not the only copy, in fact it’s a fork of someone else’s.)
Anyone is free to host their own repos on their own servers
If we don't like that we need to enact regulations
There are already many forms of protected speech that are banned from GitHub, this is not proving anything.
With the original takedown, Microsoft would be worried that the relative nobodies disappear with Microsoft left holding the bag. If Microsoft instead knows that it’s backed by the EFF who is itching for a Supreme Court fight, they might instead tell the USG “here’s their mailing address, you guys settle it in court”.
https://nitter.net/matthew_d_green/status/156181304633874841...
Why not be smart, and host the repo on Codeberg, away from the US of A
Professionals legally create explosives (military, demolition, mining etc) and literally “cook” meth (the brand name for legal prescription methamphetamine is Desoxyn in the US). These necessary and legitimate jobs require educated individuals.
How about "Anyone using https will face prison time"
OFAC may be overstepping its mandates.
Https was only made possible thanks to the legal battle fought by Phil Zimmermann.
Cash isn't compliant. Cash exchangers are.
Monero is cash-like and exchanges can be compliant and sell Monero in the US (a few do). It's just a lot of extra work, especially including the additional fraud risk it brings them.
Is it possible to design an algorithm that comes to a consensus on what new address to use faster than the legal system can sanction them?
For those of us with licenses from the US treasury for exemption from a specific sanctioned entity, this is still important.
there is a sanction on US persons from merely interacting with the deployed Tornado Cash contract, so there is a potential fine and prison sentence for just doing that. The license removes that liability.
the assets you receive out of Tornado Cash can be used the same as before. Exchanges may flag those funds arbitrarily, but other smart contracts and merchants do not. Many people stay directly on chain and pay for goods and services, and invest, without issue. Many people can derive real world benefits from things they purchase with their crypto, whether that thing is digital or physical. Its not about "cashing out", but if so, those people can still just deposit into some onchain lending service and cash out the borrowed funds, as exchanges themselves don't dig that deep and if that individual has the OFAC license it doesn't matter.
for those that choose to go to the treasury to get a license, they can always prove provenance of their tornado cash assets and prove they're clean, which is a key feature of tornado cash. so its not a good assumption that the treasury would target that person to make a deal, because there wouldn't be any liability at all, only the novelty of making the application for the license.
As you evidently know, that's the defining characteristic of a license: it removes criminal or civil liability for an otherwise illicit act. For example a Barber's license permits a person to hold a knife to someone's throat without it being assault, modulo some additional conditions. So much for generalities.
To the specifics, you look to be quite well informed on this particular matter. Are you saying that someone that has assets in Tornado that they cannot otherwise cash out without violating sanctions can lawfully sell them to a licensee, but nobody else? Because if so that sounds like a wonderful buying opportunity for the licensee. Or is getting a license trivially easy, such that anyone with assets legally tied up can just go through a TSA pre level process to establish that they're not an international terrorist drug dealing child trafficker, or whatever activity these sanctions are meant to discourage?
a) the person already having assets in Tornado Cash also being the licensee to withdraw assets from Tornado Cash. the assets they withdraw are as liquid as any other non-TC assets and do not have to go to a fellow licensee.
b) a person that wishes to continue depositing assets into Tornado Cash is also the person that is the licensee.
the only reason for the license is for interacting with the Tornado Cash smart contract - as by default that is currently a sanctions violation for US persons - it has nothing to do with whether another recipient is comfortable accepting those assets, and that isn't a limitation of liquidity at all.
Hope that makes sense. The license is just a bureaucratic nuance for people that dont want to gamble with liability. They can totally try to hide it and risk a sanctions violation charge.
Your TC money isn't any more laundered than a pile of cash you got by selling meth.
Laundering means making up some origin for such money (such as a business).
If someone pays for a house with casino chips, and you don’t do your diligence on why they chose that mode of settlement, you’re rightfully exposed to legal risk if they were in fact laundering money.
Definitely feels like a false narrative has been created by the fact they're able to point it out.
Like pointing at someone and accusing them of hiding, but the very fact you can point them out means it's either not actually happening or not happening very effectively.
> Exchanges in America at least are supposed to consider accounts receiving funds from mixers as "high risk" and apply extra scrutiny/shut down accounts.
I believe there's a level (I think $3000) for the "travel rule"[1] to apply.
It's obviously easy to bounce the money through some "NFT sales" too if you want.
[1] https://www.fincen.gov/sites/default/files/advisory/advissu7...
ehhhhhhhh. you can play with asset prices and valuations to fix this.
you have a little clean money savings from your job right?
okay, great, with a little bit of dirty/flaggable money in a different address, launch an erc20 token and liquidity pool, add 100% of the erc20 to the liquidity pool.
now with your clean money, be an early buyer.
now with MORE of your dirty/flaggable money (other tornado cash notes withdrawn to different virgin addresses via the relayer), buy into the liquidity pool. this pumps the price of the token.
now with your clean money, sell. cash out, pay capital gains tax, move on. indistinguishable from any other crypto trader. bots and many others would have bought into the liquidity pool too as they have alerts.
everyone else can play amongst themselves in perpetuity, and it can't go below the initial price that you set when you launched the pool (in Uniswap V2 style liquidity pools, and just if you want to feel better about it). hey, maybe if it keeps running then your tornado cash funded addresses might be able to sell back into the liquidity pool again.
virgin addresses funded by a third party relayer does that.
you don't want your $30,000,000 bridge heist funds to be buying a newly launched token. you want a bunch of unknown sources to be buying the newly launched token, various identities.
edit: actually I could see the crypto community finding it hilarious and "aping in" knowing that a large buyer is supporting. easier to blend in.
Please.
The hiding is a real issue here.
> A republished fork of the banned-on-sanction-order Tornado Cash repositories
Or probably a better link would be to "Tornado-Repositories: an archival fork of the Tornado Cash source code" [0].
The Tornado Cash mixer was sanctioned or banned by the U.S. Department of the Treasury (the Office of Foreign Assets Control).
Those are different things.
The GitHub account of Tornado Cash developer Roman Semenov was suspended by GitHub.
Jeffrey Blockinger, general counsel at Quadrata, says most developers don’t need to be concerned about an arrest. “While privacy concerns are legitimate, this arrest is reportedly focused on evidence of actual criminal activity,” he told Protocol.
https://www.protocol.com/newsletters/protocol-fintech/tornad...
No one "censored" anything. The Department of the Treasury didn't sanction an "idea". GitHub took down an actively-maintained software project on their own servers that was in use in practice as a money laundering tool.
Now, should the source code to that project be available from other, more trustworthy maintainers? Maybe. I tend to agree with the EFF here that this is something that needs to be allowed.
But the idea that this is some kind of oppression of innocent open source hackers is... really not what's happening. And pretending otherwise seems unserious to me.
I agree that law enforcement and gov't would want to prevent money laundering. They targeting individuals involved in money laundering is right and just - as long as it is done within the confines of the law.
However, the code does not break the law, in the same way that a gun does not kill. It's the person.
So the code should be freely available.
If it turns out that everyone in society ends up using the code to "break the law", then the law needs to be revised.
And github took it down because they fear government reprisals for publishing it. Getting nitpicky about whether you personally call that censorship or not seems like it's being deliberately obtuse, surely you understand the intent and accept it's a reasonable use of the word.
(What's more censorship can even apply to purely private actions under common definitions, and can also be objectionable especially depending on the motive.)
> Now, should the source code to that project be available from other, more trustworthy maintainers? Maybe.
Should an idea be censored if one person publishes it, but allowed to be published by others? I can't follow the logic behind that. There are reasonable arguments for censorship, but they're almost all based on the content of what is published. The only exception I can think of are false or unfounded claims where the knowledge and intent and perception of the person publishing could be factors. That doesn't apply here though, so what's your reasoning?
> But the idea that this is some kind of oppression of innocent open source hackers is... really not what's happening. And pretending otherwise seems unserious to me.
Pretending censorship isn't censorship because it may not fall neatly under a clause in a country's constitution doesn't seem serious to me.
No, that's not right. The Tornado Cash contracts, built specifically from that github project, were in active use on the blockchain. That's a machine, not an idea.
You're right, that there's semantic space to talk about the distinction, but that github project was directly conflating the two. So it was killed. Now we have another project, run by a researcher interested in blockchain technologies and not someone trying to run a crypto tumbler. And now the argument seems to have some more reasonable weight.
But please don't pretend that the Tornado github project existed for some kind of abstracted idea of discussion. It was a practical project designed to be used for crypto mixing, and as such deserved to be regulated that way.
Visa, Mastercard, Western Union, Paypal and plenty of others are also "in use in practice as a money laundering tool" and yet for some reason they are not shut down.
Tornado deliberately does not have any KYC process - indeed, the entire point of it is to obscure knowledge of ownership of (possibly stolen) money.
Tornado Cash isn't for laundering money, it's for breaking the chain of public transactions on block explorers. It doesn't make withdrawn fees look "legitimate".
Tired of these goal posts getting moved.
I can use Torando Cash to conceal the origins of my paycheck, for example to preserve my privacy when transacting with peers.
I'm sympathetic to the free speech argument, but also, if I put up plans for the Kitty Murdulator 9000 whose principally designed to kill kitties, then yeah I'd call that bad. Like sure you could do something else with it I guess, maybe, but it's clearly designed for one thing, and one thing only.
Don't want your transactions to be public? Use a bank like a normal person.
An obvious example would be a software engineer working in web3 that gets a portion of their pay check in a crypto asset.
I think something like 1/4 of all the transactions on Tornado were laundering lol. Imagine any other business that operated like that. For instance, a bank where 1/4 of tellers are stealing the deposits of customers. At some point, the banking that happens is incidental to the actual business.
So like, if you have a legitimate use for the service, and you know that by participating you're facilitating money laundering, you're complicit IMO. And if you don't want to be complicit, go find a different service.
This privacy-absolutism is silly though.
Second, if true, is that a good thing? Or are you saying that if one person is getting away with something then everyone should just be able to do it.
This has big 'but mom, Jeffrey Dahmer got to kill and eat people' energy. Nobody gets to kill an eat people. Just because Jeffrey Dahmer did it doesn't mean you do. And it doesn't mean we should be building tooling that allows people to more efficiently kill and eat each other just because one guy found a way to use it as a hat pin.
Estimated ~60+% of worldwide employment (and 15+% of GDP) is "informal" thus no verifiable source of legal funds would be found if those persons put it into Tornado Cash. I'm not sure how you define the 1/4 cited figured in Tornado Cash, but the point is I'm not sure that it indicates anything unusual about the proportion of transactions, especially considering informal workers tend to have less access to the formal banking system.
Whether that is a good thing? I don't know, I guess it would be better if those people starve to death so they could make sure they had a traceable source of tax-paying employment? This kind of thing probably covers the vast majority of people in places like Argentina where the tax on corporations is 107% of profit [see publication 'doing business argentina'], that is there is basically no legal way to run a business fully above board. I definitely don't see these people trying to survive on otherwise honest employment as Jeffrey Dahmer, but I agree it would be better if they had a way to work that allowed them better access to the banking system.
To put it simply using your analogy, if 1/4 (or more) of the wold is 'Jeffrey Dahhmer' it doesn't look like your service favors Jeffrey Dahmer if only 1/4 of the service is servicing Jeffrey Dahmers.
the owner of the money decides to do that; private transactions are a thing
Tornado Cash has legal uses under the law (like the one I described above), because it can be used to conceal the origins of legally obtained money.
See the legal definition of money laundering here: https://www.law.cornell.edu/uscode/text/18/1956 , it specifically calls out "unlawful activity".
For example the money stolen in the Axie Infinity hack was lauded through Tornado Cash.
Probably. After it’s been publicly outed as a known money laundering venue, however, you should switch to another service. It’s also reasonable for everyone who deals with you henceforth to subject you to additional scrutiny, to make sure you were not in face laundering. Because while the privacy vs. friction tradeoff may be acceptable to you, it’s not to everyone, and just as you have a right to privacy they have a right to not associating with you.
Cash was and is still not very trackable; it's so untrackable that the IRS has to declare what events trigger tracking. Something like Tornado Cash just mixes what it's comparable to a credit card purchase down to being as trackable as cash. I don't see a problem with that.
Whether or not criminals use it is really not of concern to me. The FBI, CIA, and NSA can do their jobs just fine without transaction tracing. The fact that their jobs remain hard are also an indicator of freedom. Their jobs have already gotten quite a bit easier with the birth and success of the digital world.
The result of money laundering is clean money: you can deposit it into your bank, pay taxes on it, and buy a Ferrari. That only happens if you can give the IRS a plausible explanation for how you obtained the funds legally.
Tornado Cash does not give you this plausible explanation. After using it, you still will not have clean money with an IRS-approved explanation of income. All you gain is privacy from chain analysis.
You could launder money through a restaurant or minting a NFT, since those are otherwise legal activities that could plausibly explain ending the day with more money than you started with. But Tornado Cash does not fit that description.
You are free to use the proceedings even if we know for a fact that the originating wallet had proceedings of illegal activities.
The crime has been washed.
If you sell 100 ETH worth of crack and send it through Tornado Cash, you cannot buy a Ferrari. The IRS will come knocking and ask where you got the cash. First you would need to launder the money.
You can trade your Tornado Cash ETH for a Ferrari. But after you drive it home, the IRS will still come knocking, because you didn't launder your money.
because most people aren't a fan of tax evasion, black markets or crime. The same does in fact apply to cash which is why many jurisdictions heavily restrict large cash transactions and are in the process of reducing the usage of cash or circulation of large bills.
I think the NSA, FBI and CIA being able to do their job is a good thing because I'm not too keen on making the life of money launderers any easier.
People don't money launder cash to hide where it came from, they money launder cash to provide a reason why they have it.
It sounds like the same thing, but it those are really two different things.
(I'm not a Tornado Cash proponent, but I am a digital financial privacy proponent; I support the Monero project.)
Similarly, there are other uses for anonymous money than laundering illegal money, for example, getting an abortion, buying a gift, having a vacation in Las Vegas as a Korean citizen (they get prosecuted for gambling overseas), anonymous donations, etc.
The technology to grow food also grows drugs; to teach technology is to teach all its applications, even if it goes unsaid. That doesn't mean we should forbid people learning to grow food in case they might grow drugs, or might launder money.
There are research papers that show that TC withdrawals can be linked to TC deposits with a good level of confidence.
I'm sure a great deal of analysis was done by the US, which led to their actions, like it or not.
There are knee-jerk reactions in the Crypto Community fearing that they will be next, and restricting access to their projects. No self-awareness of the truth about the "Decentralized" nature of their projects.
Cheers
In this world going ever faster down the drain attacking something that compared to its peers seems fairly benevolent like a democratic state, looks ever more like a bunch of cocks, sitting on a manure heap, sounding the cry to battle, while the whole assembly drifts downstream in a flood.