Hacker News Reader

> The key issue is that any collateral damage is considered acceptable, but any false negatives are absolutely not.

Even though “better 100 guilty persons should escape than that one innocent person should suffer”. Not that this was ever uncontroversial, but how did it ever go so wrong, that the very problems of government that modern laws sought to correct are gleefully recreated using private companies as enforcement proxies?

Companies try not to break laws in general. If they think doing business with you will create a liability for them, they have a freedom of association right to deny you service.

Giving a legal answer to a moral question is backwards, I think. I understand the mechanics of how it works, but I’m asking how it should, not whether it does. (Franklin’s opinions on how trials ought to go are also hardly representative of the legal practices of the late 18th century.) It is not at all a universal opinion that non-natural persons should have freedom of association at all or in this manner.

I’m not trying to directly argue that they shouldn’t, though (as long as we allow that there is no moral principle that a non-natural person’s rights follow a natural one’s). I’m saying that it’s generally accepted to be a good thing that a (branch of) government can’t directly take away your livelihood without a good reason, and if you think the reason was not good there are reasonably unbiased ways to have your disagreement considered. For the most part, this applies to a government doing it by prohibiting a private party to deal with you. On the other hand, if the same state of affairs is reached by that government merely making it potentially very expensive for a private party to deal with you, somehow none of these standards apply anymore (or maybe they nominally do but nobody’s ever succeeded at enforcing them, which amounts to the same thing). That is what gives me the chills here.

>government can’t directly take away your livelihood without a good reason, and if you think the reason was not good there are reasonably unbiased ways to have your disagreement considered

OFAC sanctions can be appealed.

> The argument probably is that they assisted a sanctioned entity by providing a contribution i.e. service to it.

And what if they did so before the sanctions? Is the US so happy to retroactively punish people who literally did nothing wrong?

> people who literally did nothing wrong?

What on earth did people think a tumbler like Tornado Cash was going to be used for and by?

Not sure, thoughtcrime is a thing now in modern America?

> thoughtcrime is a thing now in modern America?

Nothing wrong with writing code. Code is speech, that's settled law. But the Tornado Cash team wasn't just publishing. They were building a tool. Semenov styled himself as a co-founder and the group advertised open positions on its website.

Okay, how does that relate to open source contributors? Can you retroactively read their minds and determine their intent? Why does their intent even matter? What they were doing was not illegal at the time, and now they are being punished by the US.

> now they are being punished by the US.

The US didn't mandate deletion of their Github account. The US isn't punishing them – you can tell because they didn't put them explicitly on the SDN list.

Microsoft made the choice to remove their accounts. Their compliance team likely looked and said "$ we make from these devs < $$$ we'd pay to our lawyers to simply decide if we should keep them on our platform."

> Why does their intent even matter?

It doesn’t. Tornado was used to launder money. That’s all that matters.

My guess is the only people in real legal jeopardy are those who kept working on it after its involvement in laundering was exposed. (I’m assuming they weren’t in on the laundering.) For GitHub, figuring out who those people are is impossible. So they’re being cautious and cutting ties more broadly.

There is a creep problem to sanctions. Some companies in Russia are banned. Suddenly everyone from Cyprus is under extra scrutiny, since you don’t want to be the dupe they used to launder their money. Tornado and its developers were those dupes. But it has been illegal to help North Koreans launder money since before Tornado was founded. It remained illegal when it became known North Korea used Tornado to launder money. Anyone going into money services knows, or is negligent in not knowing, that these laws apply to them. It’s tough to have sympathy for anyone who kept ties. Particularly when the punishment, so far, is simply ostracism.

Is that settled law? Have the anti-circumvention parts of the DMCA been struck down?

You ask this as if there are only non-legitimate uses. Do you think businesses often give away their revenue data to their competitors for free? Of course not, so if you want to do business on an open ledger then you have to have a way to obscure transactions so that your competition doesn't get to know exactly what your revenue stream looks like.

There's nothing sinister about privacy. It would be a logical fallacy to assume that just because sinister things happen in private that privacy itself is sinister.

> nothing sinister about privacy

Totally agree. One damning aspect of Tornado is we know it was used to launder money. Criminals used it. This was publicly reported and certainly known to the Tornado team.

If you know your product is being used by criminals to do crime and you respond by shrugging your shoulders, I’m not sure what the expected outcome is supposed to be other than getting dinged.

I like to ask myself what money laundering even is and whether it makes sense and ideally it wouldn't even be illegal. Money laundering isn't the crime - it's just a convenient tool to dissuade crime. Ideally there would be no crime without violence and there is nothing but consenting individuals involved in money laundering. The crime happened before the laundering and that's what we should be preventing.

Otherwise you end up in situations like this where innocent people are going to get screwed over because they utilized a tool that criminals utilized. This isn't fair or just by any standard and I personally don't accept the collateral damage as worthy.

This doesn't even begin to touch on the vast majority of laundering that happens in fiat across international banks . That would take a while just to list all the infractions that are constantly happening, yet those entities are still not only operating in the free market, but they have federal insurance and backing.

> what money laundering even is

Hiding illegal gains.

> crime happened before the laundering and that's what we should be preventing

Covering up a murder is a crime because we don’t want people helping murderers cover up.

> like this where innocent people are going to get screwed over because they utilized a tool that criminals utilized

People who used Tornado Cash aren’t getting screwed. Even the developers aren’t. They aren’t personally sanctioned. Their work, which has been used to launder money, is.

Third parties, like Microsoft, are choosing not to associate with them. (The developers who knew about the laundering, e.g. through the public announcements law enforcement made, and kept working on it are far from innocent.)

> doesn't even begin to touch on the vast majority of laundering that happens in fiat across international banks

Yes, there are other crimes.

People laundering money through banks get sanctioned and jailed. When banks make a habit of laundering money, they too get sanctioned. There is ample historical record of all of this.

> People who used Tornado Cash aren’t getting screwed.

Incorrect, as per sanctions putting the onus on private entities to get things right, circle has blacklisted any USDC address that has been owned by the tornado cash protocol, which means anyone using tornado cash for legit purposes will lose every dollar they had in USDC. I'm really not sure how you came to the conclusion innocent people weren't getting screwed here, but it's irrefutable that they are, unless of course your definition of guilty is someone that used tornado cash, which would be a silly definition. I've used mixers plenty for completely legit reasons. I don't want people knowing how much crypto I have and I don't want to manage tons of addresses so when I transact in open ledgers I have at times had people pay me via mixers to hide the addresses I own and thus hide how much crypto I own from people doing business with me. All completely white market business dealing with buying/selling electronics too, for that matter.

> People laundering money through banks get sanctioned and jailed. When banks make a habit of laundering money, they too get sanctioned. There is ample historical record of all of this.

Incorrect, they pay fines that rarely even cover the profits they made to begin with.

> circle has blacklisted any USDC address that has been owned by the tornado cash protocol, which means anyone using tornado cash for legit purposes will lose every dollar they had in USDC

Wasn’t aware of that. Fair enough. Innocent people will get harmed.

That said, innocent users whose USDC was frozen haven’t lost their money. They’ll have to show they weren’t laundering money. When they do, they should be able get it unfrozen. If that doesn’t work they can pursue legal remedies, though the law in all of this is obviously undeveloped. We are in dire need of stablecoin legislation; something to add might be controlled redemption for users the issuer no longer wishes to associate with.

Their situation is analogous to getting money stuck at PayPal. If you don’t want to take that risk, don’t use PayPal. If you don’t want to run the risk of your stablecoin getting stuck, don’t use mixers. Particularly after they’ve been publicly identified for laundering money.

People have been talking about all of this for years. It was continuously shouted down, or claimed to be impossible because blockchains are above the law or something. I get that there was a lot of noise above that signal. But like, it’s North Korea. On the balance of harms, of course this is what happens. There was never another endgame. The wheels of justice just turn slower than bullshitters spin yarn.

> They’ll have to show they weren’t laundering money. When they do, they should be able get it unfrozen.

I hope you're right, but the process to make this happen will be painful and slow and the damages will not be compensated I suspect.

> If you don’t want to run the risk of your stablecoin getting stuck, don’t use mixers. Particularly after they’ve been publicly identified for laundering money.

Following this logic, should people stop using HSBC or any of the top international mega-banks? We're talking about banks that didn't "accidentally" let money laundering happen. They actively facilitated it. HSBC specifically laundered money for one of the most violent cartels in the world and not a soul went to jail.

Bit of a rant, but my point is that exactly where should people keep their money that is safe from being caught up in laundering? Such a place doesn't exist as far as I'm aware.

Morally speaking? Yeah, you should probably not use those banks if you care about the ramifications of money laundering.

Practically speaking? HSBC laundered $881 million in 2012 – but they had trillions of dollars of assets under custody. They may have to pay a big fine, but your ability to get at your money will not be impacted.

And even if you deposited your money into your account at "Money Laundering Bank N.A." where everyone but you was a specially designated national, you still have legal recourse to those funds backed by decades of case law. That same case law might help you if you keep money from a mixer in stablecoin that becomes frozen, but it's going to get way hairier.

> If you know your product is being used by criminals to do crime and you respond by shrugging your shoulders, I’m not sure what the expected outcome is supposed to be other than getting dinged.

You are aware that criminals use all the same thing as you an me right? They use toothbrush too... should Coldgate not shrug their shoulders? Sure they don't commit crime with them, but they do use them. Want something they use to commit crime? Guns to kill, cars to evade, bags to carry the money, etc... what should all theses companies do? Let's go even closer, about privacy, what about balaclava manufacturer, it's the default thing considered for banks robbers, yet they still sell them!

I don't have all the details in this case, my guess is that Tornado Cash were aware that it was used by theses countries and could have stopped theses specific accounts (it would keep going for sure without their knowledge using alternative accounts obviously, just like many of theses countries still are able to get Windows illegally, but at least they would no longer be aware of theses accounts). In that case it does makes sense and I agree with the direct sanction of Tornado Cash. I would still disagree with the blanket sanction over the open source contributors, as they might have contributed without knowing it was used by sanctioned country.

Writing all that made me think of a question: do you believe contributor to Windows should be sanctioned too knowing that Windows is used in some of the sanctioned countries?

> would still disagree with the blanket sanction over the open source contributors

No contributors have been sanctioned. Three leaders had their GitHub accounts deleted, from what I can tell, and are trying to misrepresent that as a threat to everyone who ever touched the project.

As an example, it seems plausible to me that a person who wants to enter the cryptocurrency sector could send a pull request and actually work with them to get merged to put it in their resume.

This person can be totally oblivious to the illegal stuff that's happening behind the scenes. After all they were just trying to prove that they actually have experience with cryptocurrency code to potential future employers.

It also can be some random security researcher who is preventing open source developers from shipping vulnerable code. I know for a fact that Github themselves employ such people that send security-related patches from time to time to open-source projects.

You can work up more examples -- my point is that people who definitely have nothing to do with any illegal activity whatsoever could exist in the list of contributors of these repositories.

It's nice that they didn't just nuke the whole contributors list, but it's still a bit unsettling.

> it's your responsibility to know and check who you are dealing with.

What can I say, duly noted.

The unfortunate reality is that there are no guarantees. I once inadvertently helped someone commit suicide. I had no idea until after he did the deed and there's no realistic way I could have known beforehand.

Sometimes you just have to assume that everyone's operating in good faith.