Hacker News Reader

Comment by holmesworcester | Hacker News Reader

How many people here on HN have submitted a PR that criminals could use to do bad things?

Security tools, encrypted messaging, jailbreaking tools, VPNs, file hosting tools, anonymity tools...etc.

The complaint itself cites 'writing instructions on how to use a VPN' as evidence that the developers were knowingly doing something criminal. A VPN!

You might hate crypto and believe that open source private money is different than open source private messaging. But that is not what the government's ability to jail these developers hinges on. Any argument prosecutors are making here could be made (and in many countries has been made) about any of the tools I list above. To cheer this on is to throw the past 40 years of legal advocacy around privacy, encryption, and anticensorship tools in the trash.

View on HN

They didn't "just" send a PR or "just" write some code, they made a financial tool which earned them millions while ignoring regulations for these type of financial tools. No one who sent a PR was arrested or even investigated: just the people running Tornado. This has been pointed out time and time again.

Crypto wants to be taken serious as a financial tool. Okay, fine. This also means you have to follow the same rule as anyone else.

Don't like these rules? Fine, you're allowed to – we have a democratic process for changing that so go vote, lobby, etc. Remember the 2008 banking crisis? There are reasons these regulations exist.

Banks get fined for these types of things all the time too: https://duckduckgo.com/?t=ffab&q=bank+fined+money+laundering... – crypto isn't being singled out here.

If you knowingly ignore the laws for personal profit you can expect consequences like this. Cryptopeople want to live in some sort of magical fantasy world where they both want to interact with real money and the financial markets when it suits them, but also pretend specific laws and rules for it don't apply to them when they're inconvenient. All while they're lining their pockets of course. Maybe this world has unicorns and dragons and teletubbies too.

> They didn't "just" send a PR or "just" write some code, they made a financial tool which earned them millions while ignoring regulations for these type of financial tools. No one who sent a PR was arrested or even investigated: just the people running Tornado. This has been pointed out time and time again.

Since TC is still running with both guys in jail, they clearly weren't "running it" - but the Ethereum node operators are. Should they be arrested? Are you answering this question as a laywer, or as citizen engaged in the democratic process telling me what you feel the law should be?

They were developing it and making money from it, so that's "running it" by all but the most boring pedantic definition.

Ethereum is a protocol and a tool, which Tornado used it to knowingly profit from illegal transactions. Ethereum is somewhat akin (not identical) to USD, and Tornado somewhat akin to a bank operating with USD outside of the law.

I was unaware I need to get a university law degree before commenting here.

Laws are all about boring pedantic definitions. And when you talk about what counts as ignoring laws, or about what consequences people "can expect", those definitions matter.

I am obviously not argueing this case in court here, and expecting the same standard from random HN commentors is not reasonable. The basic facts from my previous comment are accurate and have been widely reported for a long time, and it's pretty clear what's intended. Trying to nitpick on the exact language as some form of "rebuke" is not exactly constructive.

> Ethereum is somewhat akin (not identical) to USD, and Tornado somewhat akin to a bank operating with USD outside of the law.

Many people are arguing that Ethereum node operators should be on the hook when they facilitate Tornado Cash transactions through their participation on the network. I'm glad we can count on your support should such arguments ever be pursued legally. Thank you.

You can't cherry pick that out of context, criminal indictments often cite things that can be ordinary. Buying duct tape isn't a crime, but it can be evidence of a kidnapping.

As far as I can tell these people created a business to profit off of money laundering, and they were helping teach people how to hide their identity.

Yes. We agree completely on the facts here. These people built a business to profit off the provision of online privacy, and as part of they were helping teach people how to preserve their online privacy.

Some people used their tool for money laundering, just as some people have surely used encrypted messaging and VPNs for theft, terrorism, child abuse, and other crimes.

The point is that online privacy always has significant legitimate, non-criminal use cases, and developers can have legitimate, non-criminal (noble, even) reasons for building for those use cases.

And the larger point is that, if we want to have tools that give us any meaningful online privacy, we must stand up for the developers that build such tools when they are (inevitably, perennially) accused of aiding criminals and terrorists.

The government is going to make the case not that a tool was made that could be used for money laundering, but that a tool was made to intentionally allow for money laundering. The former is not illegal, the latter is.

But regardless of intentions, not following KYC/AML rules is illegal.

> But regardless of intentions, not following KYC/AML rules is illegal.

KYC/AML rules are of questionable legitimacy themselves, IMHO.

With less and less of society allowing to pay in anonymous currency (i.e. cold hard cash), either because it's dropped for "security" (i.e. shop owners don't want to pay for security to make sure the cash ain't stolen) or because of legal requirements (see e.g. Italy limiting cash transactions to 5.000€ in value, or Germany requiring a notification if you pay more than 10.000€ in value for a car), and many people moving to card payments due to convenience, there will be no way to escape the dragnet of governmental and private surveillance as all bank accounts are identifiable per KYC/AML regulations and virtually all banks report all account holders to Equifax and the other credit bureaus so to find out where a person banks is only a subpoena or a hack away. Oh, and completely forget about hiding legal but still sensitive payments: sex work of all kinds, political engagement, everything becomes yet another line in a trove of data lakes.

And that doesn't even touch the subject of card processing fees. Mastercard and Visa are rent-seekers of the worst kind, and no one seems to be willing to break them up or cap their fees, with PayPal close behind. Instead, everyone looks away when they cave to Evangelical pressure campaigns and drop sex workers left and right.

KYC/AML regulations deserve to be torn apart, and the people deserve privacy in their lives. Or, alternatively, we should force elected officials to open up their bank accounts to the public. If we can't have privacy, they certainly don't deserve it either.

You're making an argument about what the law should be. In many ways, I'm very sympathetic to those arguments.

But that's not what the law is, and law enforcement agencies as well as the court system only deal with what the law actually is.

You can (and should!) agitate and work towards changing the law to be more in line with what you think is right. That's the sort of change that is entirely possible in our system. But until then, the law is what the law is.

These are federal conspiracy counts. Overt acts don't need to be crimes, they just need to be proof of the furtherance of a criminal conspiracy.

Making a crowbar isn't illegal. Buying a crowbar isn't illegal. Emailing your buddy and talking about how you're going to bust up a person and their shop because they aren't paying you protection money, then making or buying the crowbars? That could be evidence of an overt act in furtherance of a criminal conspiracy.

That example reminds me of some follow-on commentary:

> And the only thing I would add is a few other scenarios. The third scenario: A person says to themselves "I'm going to go out and buy a crowbar to [...]" and then I go out and buy a crowbar. Still not a crime because there's no conspiracy, i.e. an agreement with another person.

> [...] And then there's the fourth scenario: A person says to themselves "I'm going to go out and buy a crowbar to [...]", buys the crowbar, and and then actually starts hitting people [...] Now there's still no conspiracy, but you've taken a substantial step towards the crime and and likely completed the crime and you're guilty of the initial crime.

[0] https://www.youtube.com/watch?v=SbIhNmoZLJQ&t=3m00s

The indictment says they knew they were laundering proceeds of a specific hack, by a specific group.

See page 24

Not "they created a tool and it got misused" but instead "these specific criminally sanctioned folks are using our tool to launder 600 million dollars, and we know, should we do something about that?"

Their messages back up that they know it was being used in a specific instance, by criminals, to launder money, and they did nothing.

Sorry, no sympathy. I'm with you that we need to ensure tools are available, and i'm even okay arguing about KYC/etc.

But when you have specific, actual, knowledge that a criminal actor is using your tool to launder money, and you do nothing, sorry, that's just aiding and abetting.

The smart contracts are immutable nobody can change them including the devs. When prosecution says "did nothing" they should probably mention that it was not technically possible to do anything productive.

You seem to think this matters, but the charges are conspiracy, so it in fact, does not. Their part of the conspiracy was already complete, whether they could do anything or not.

If you create parts for a bomb and hand them to someone else, knowing they are likely to use it as a bomb, and they in fact do, you are as guilty of conspiracy as the actual bomber.

Your crime was complete when you gave them the parts, which is an overt act (some act in furtherance of the conspiracy).

(Unlike the typical gun analogies that get brought up in response, i'm choosing something that does not have a legitimate purpose and is in fact illegal to create as-is)

If you create a thing in the US that is required to comply with KYC/AML and don't, and someone users it to launder, and you know they use it to launder, you are still guilty even if you couldn't stop them from using it.

Again, your crime is complete at the point you complete an overt act .

You have to withdraw from the conspiracy before then.

Here, the government is charging them for the website, mainly, not the smart contracts

What could they have done?

If the government has records that you wrote a service that specifically violates the law, that you contemplated a change that would make it compliant but didn’t because your customers won’t use it, they are right to charge you with a crime.

I’m a privacy advocate, who thinks kyc laws have gone too far. But if you knowingly break a law you can’t cite the unjustness of that law unless you are engaged in an act of civil disobedience. Profits will suffer is not civil disobedience.

When Signal becomes illegal in, say, the UK, will you support the extradition of Signal developers to the UK simply because they're knowingly breaking the law? At what point does it matter what's right?

What about the GP's comment implies that they support extraditing people to foreign countries?

Signal is threatening to leave jurisdictions where they become illegal rather than comply. They're not threatening to keep operating in violation of the law.

What does "leaving a jurisdiction" mean? Can Tornado Cash "leave the US jurisdiction" as well and will then be left alone?

Will you support the UK if they ask for the extradition of Signal developers, on the basis that say Signal will continue to have UK users accessing their service?

Where are your values?

> What does "leaving a jurisdiction" mean? Can Tornado Cash "leave the US jurisdiction" as well and will then be left alone?

You can - by not being inside the US, doing proper KYC and rejecting US customers.

> You can - by not being inside the US, doing proper KYC and rejecting US customers.

Looking forward to doing KYC on my Signal account then.

They're not being charged with "writing a service", because writing software isn't illegal no matter what it does.

They're being charged with operating a service. Which they may very well have done. It sounds like they were at least running the front end user interface stuff, and that might be enough.

But what makes it interesting is that the real core parts of the whole system were (and still are) autonomous. Those contracts could (and still can) be used without them doing anything at all. So they were not operating those. And it's not so obvious that there is any settled law that applies to those core contracts.

The government has records (presumably electronic) of the charged individuals making a specific decision not to be compliant to improve their profits. It’s hard to see any precedent being set by that other than “don’t run explicitly illegal services”.

> The complaint itself cites 'writing instructions on how to use a VPN' as evidence that the developers were knowingly doing something criminal. A VPN!

Do you have a link and paragraph number for this quote? I searched in the press release [0] and OCR'd the indictment [1] and can't find any match to any part of that quote ("VPN", "writing", or "instructions"). I also can't find any match for that quote anywhere on Google.

[0] https://www.justice.gov/usao-sdny/pr/tornado-cash-founders-c...

[1] https://www.justice.gov/media/1311391/dl?inline

> The complaint itself cites 'writing instructions on how to use a VPN' as evidence that the developers were knowingly doing something criminal. A VPN!

As if the modus oparendi of sketchy crypto sites wasn't shouting off the rooftops "You can't use this site cause we detected a US IP we don't do business with US citizens. BTW, here's how to use a VPN!"

It's a far cry from what some members of the tech community did when the government was trying to restrict code and cryptography in the 1990s. People were tattooing perl scripts onto their bodies in order to protest the restrictions. God forbid people break the law to protest bad laws.

"How to become an Arms Trafficker

Become an Arms-Trafficker in one easy step with this great way to register your protest of ITAR by Vince Cate. Just click to submit the form and join in the protest. Lots of excellent links. Have you exported RSA today? Includes an option to email a protest letter to US president." [0]

[0] http://www.cypherspace.org/adam/rsa/

> It's a far cry from what some members of the tech community did when the government was trying to restrict code and cryptography in the 1990s.

So? All that means is that there were people who thought that was a just fight and don't think that this is a just fight.

> God forbid people break the law to protest bad laws.

That's a legitimate form of protest and I won't condemn it. But when you break a law out of protest, you are still subject to arrest and prosecution for doing that. And often, that's the result you actively want because it brings attention to your cause and gives you a platform to argue the injustice in court.

That said, it doesn't look to me like the accused here were engaging in civil disobedience. It looks like they were pursuing profit.

Reply on news.ycombinator.com