Hacker News Reader

Comment by jacooper | Hacker News Reader

More details here:

https://www.eff.org/deeplinks/2022/08/code-speech-and-tornad...

> In keeping with our longstanding defense of the right to publish code, we are representing Professor Matthew Green, who teaches computer science at the Johns Hopkins Information Security Institute, including applied cryptography and anonymous cryptocurrencies. Part of his work involves studying and improving privacy-enhancing technologies, and teaching his students about mixers like Tornado Cash. The disappearance of Tornado Cash’s repository from GitHub created a gap in the available information on mixer technology, so Professor Green made a fork of the code, and posted the replica so it would be available for study. The First Amendment protects both GitHub’s right to host that code, and Professor Green’s right to publish (here republish) it on GitHub so he and others can use it for teaching, for further study, and for development of the technology.

View on HN

Also related is this FAQ (mentioned in the Twitter thread): https://github.com/tornado-repositories

The first may protect the right for Github to host the repo (though even that seems somewhat a stretch), but it certainly doesn't grant or protect any right to publish on Github servers.

Can you elaborate on this?

GitHub doesn't have to host anything it doesn't want, regardless of free speech

he said it would be interesting if github chose to un-host it but then he'd just move it to a university server.

Github doesn't have to publish or host anything they don't want to, and they may decide not to for many reasons (business, appearances, phase of the moon, etc).

I mean if they don't want to because of someone's race then that is against the law. Same with religion. So start a religion that incorporates these ideals.

IANAL, but I recall a religion needs to have existed before so-and-so date (I don't recall exactly) to qualify as a religious exception. Meaning your Swimming Lasagna Monster religion you created yesterday doesn't qualify.

The scientology example tells us the opposite.

Unless one of those reasons is persistent government requests/pressure on Microsoft/Github. Then it's a convenient way around first amendment protections.

Is a subpoena, in full compliance with the law, considered to be persistent government requests.

The First Amendment rights of corporations is at play here.

> The first may protect the right for Github to host the repo (though even that seems somewhat a stretch)

There's a rather murky limit on freedom of speech, I'm really not sure where it stands with regard to instructional content in general - however some such content has been constrained before; usually regarding weapons (or really any content that the government can argue is weapons related).

It's murky, and subject to government overreach.

> but it certainly doesn't grant or protect any right to publish on Github servers.

The first constrains the government, it in no way constrains private entities.

In fact (given the corporate personhood), to require that a private entity publish content from a third party would be compelled speech, and a breach of the entity's first amendment rights.

What I took it as was “the first protects Green’s right to republish on GitHub [from government censorship].” Of course the first does not compel GitHub to allow him to do anything on their servers, but it does protect what both parties consented to do from government censorship.

> There's a rather murky limit on freedom of speech,

I don't believe it's murky at all, but defined deliberately in fuzzy terms in a number of important ways, one of which is the avoidance of precipitation of criminality. Criminality defined as that which is harmful to society. Although it may sound weak, compared to the presumed unfettered principles invoked above, should one or other of a separating couple used Tornado Cash to rinse common property funds, something that isn't drug dealing or terrorism anyhow, nevertheless it's laundering and using a device to commit a crime without which device that crime may not be possible. Federal proceedings against Tornado Cash have given the unlawful enterprise unprecedented profile and it follows that the motivation for anyone who strives for continuance of the same or similar, in light of the reasons for federal action, could be construed as being potential criminal too. Frankly I am stunned in the era that recognizes hate speech, that the automatic right to unfiltered and inconsequential freedom of speech is claimed so crudely, so reflexively and on such narrow and unexplained grounds..

Potentially criminal acts are legal.

>I'm really not sure where it stands with regard to instructional content in general - however some such content has been constrained before; usually regarding weapons (or really any content that the government can argue is weapons related

Common misconception.

You can post the machinist drawings for any unclassified (or classified, if somehow you came across them without having signed any paperwork related to security clearances). That is protected by the Courts.

Where you get into hot water is ITAR and restricted exports where free speech runs into the whole national security/foreign affairs jurisdiction by the Feds. You cannot post the manual for an F-16 for instance, in such a way as it could be accessed by adversaries of the United States. Access to that type of information has to be gated behind some form of arcane onboarding process to ensure one is actually authorized to see it.

There was an attempt at gating 3d printed gun patterns I think, but all the courts would let through is that a manufacturer must ensure the recipient is a U.S. Citizen, so it switched from published on website, to shipped on CD iirc.

Haven't checked on recent developments.

If Github consents to storing it on those grounds, they have that right, in my unlicensed opinion.

And?

>> The First Amendment protects both GitHub’s right to host that code, and Professor Green’s right to publish (here republish) it on GitHub

The first part's maybe true, the second part is bullshit.

Exactly. If they wanted to challenge the government, they could have self hosted. This is an activist play at Microsoft. Nothing more, nothing less.

"Challenging the government" doesn't make sense there, because the government never ordered anyone to take down the source code.

Microsoft just did some risk management and decided that it's not worth it to keep their own users data. I find it quite interesting that someone puts Github's management in a difficult situation. Are they gonna terminate Prof Green's account too? Are they gonna hunt down every copy of the source code on Github? Are they giving high-profile users a special treatment?

Looking forward to how this plays out.

Also wondering to what extend co-pilot has this particular code embedded.

It’s an enormous liability concern for them.

Even if some activist executive would allow it, Microsoft’s lawyers would absolutely not.

And the shareholders also wouldn’t.

Don’t forget that the purpose of a business is to create shareholder value (as defined by the shareholders themselves), and I highly doubt that the majority of Microsoft’s shareholders would see any value in this. Just liability.

Conclusion - not worth it.

> Are they gonna terminate Prof Green's account too?

Probably not.

> Are they gonna hunt down every copy of the source code on Github?

Probably.

Technically, a corporation exists to distribute risk to facilitate a venture that may produce a return, not necessarily fiscal, but nevertheless valuable to the group undertaking it.

It's a perversion of the concept to jump to must produce a positive financial return. Sometimes you just need an organization to coordinate something that eases a societal ill.

That business schools have forgotten this, and that we don't remind people of this consistently is a tragedy. It cuts off entire avenues of collective organization to get things done. Some times "getting it done at minimum outlay" is enough.

> It's a perversion of the concept to jump to must produce a positive financial return.

At no point I suggested that. I said "shareholder value, as defined by the shareholders themselves".

"value" doesn't imply fiscal.

It protects the right to publish, "on github", or by any other means, and saying that in no way says "compels github to perform a service against their will"

Why do some people jump to interpret things that way? There's something kind of pathetic at the heart of that.

Bad phrasing. The "right" is that of generally being able to seek publishing, not publishing with any one specific publisher.

Perhaps - but in a complaint regarding legal rights, phrasing is very fucking important.

If you sent an email to the editor, they might agree with you.

Every time someone points out that freedom of speech/press/expression doesn't apply to expression in a private forum they are correct. The owner of the forum has rights... but, there is a very important piece of the story this misses:

Is government the reason GitHub is removing the repo?

If so, then this is exactly an abridgment of rights, and GitHub would be an accomplice to the government is that violation. Government asking for someone's rights to be violiated, no matter how politely they do so, is still a violation of rights.

The interesting thing is I doubt the government explicitly contacted Github, it seems there's a somewhat vague "Tornado cash is sanctioned". You could imagine that Github's lawyers aren't going to take any risk. But the government could argue that Github is overreacting.

This is how the white collar world actually works. It's rife with communication characterized by non-written, non-spoken, and completely indirect forms of command giving such that it creates a plausibly deniable link through which the originator of a mandate can state they never told someone to do something, making it seem as if the agent acted entirely of their own volition, regardless of the fact they were constrained by the structure of incentives/risks put in place by the person in a position of higher authority.

Absolutely nobody will admit to the dynamic and will actively avoid any attempt at on paper recognition of it, as to do so will completely destroy/dismantle the PD chain.

In short, the government is effectively accountabilty laundering in order to for keep out money launderers.

It's because being listed is one of the things that has strict liability https://www.law.cornell.edu/wex/strict_liability So you're guilty if you do it, regardless of your intent or knowledge with no legal excuse or defense. That's a VERY dangerous place to be in.

This has already been ruled legal in the past.

In some cases, yes, and in others, no.

Granted that github sole reason for not hosting because is government overreach (first part) then in a world where github would allow publishing, then it is within Prof. Green rights to publish it.

Is how I read it.

> The First Amendment protects both GitHub’s right to host that code, and Professor Green’s right to publish (here republish) it on GitHub so he and others can use it for teaching, for further study, and for development of the technology.

Yeah it proyects it against the government. Everybody else is still free to sue, take down, deny access, whatever.

But who wants to do that other than the government? And it was removed directly because of government sanctions. I understand that the first ammendment is poorly understood with regard to private companies and hosting content online, but in this case the first ammendment is applicable.

Does the first amendment protect against treaties the US has signed with other countries requiring the government to take action or violate the treaty?

Depends on who you ask. The general feeling in Europe is that treaties signed by the USA (or Russia, China and many more) are basically worthless. I mean, when does USA ever ratify treaties into (federal) law, or into the constitution for that matter?

Republicans would say "hell no it's our sovereignty", Democrats "maybe", the American courts: "maybe but probably not"

> […] when does USA ever ratify treaties into (federal) law […]

Never. Or immediately, depending on your perspective. Either way, there’s no need for further paperwork.

> Treaties to which the United States is a party also have the force of federal legislation […]

— https://www.senate.gov/about/powers-procedures/treaties.htm

Well, it could be seen as accessory to many sort of frauds. But to what extent would that be more accessory than using a car for example - and looking for the car manufacturer responsability?

AFAIK the code was taken down in response to a government request, so this was a clear First Amedment violation.

By that interpretation, any takedown under sanctions law would be considered a first amendment violation. Which I believe the courts have already rejected.

If the government doesn't like your criticism of their policies, can they simply sanction you to disable your free speech? Where does the line go?

So host it in a different country?

Sanctions compel everyone to take sanctioned content down - not only the gov't.

As they say, why does someone pick that hill to die on? To study the code?

Because privacy is important and the elimination of it has been a huge part of most totalitarian regimes. Why wouldn’t you die on the hill?

This isn't about privacy, it's about free speech as stated above. He wants to make the code public, not keep it in private.

The technology is used for privacy.

It's about privacy, free speech is just the legal justification for being able to publish the content

Because it's his choice. Why should we care why?

I'm not a lawyer, but I don't expect this to be a a "hill to die on" at all.

If this professor is unconnected to the sanctioned Tornado Cash service, then Github shouldn't have to worry about running afoul of the sanctions by hosting the code.

Representing how? What action are they anticipating?

Well, they expect OFAC-based legal action by the government, of course.

Green wouldn’t have standing for EFF to participate if USA goes after MS. So I’m curious what they’d go after Green for.

He's the maintainer on the repository - so presumably that.

(https://github.com/tornado-repositories)

If he stands up and operates a for-profit instance of the service, then he will have committed the crime that led to the sanctions against the original operators of the service.

If he does not, then he is not a participating entity in the sanctioned service, and is unlikely to attract serious attention from the Justice Department.

It’s nice of the EFF to throw down a gauntlet about free speech, but I expect it will be ignored in favor of sanctioning others who operate cryptohash laundering services.

I don't think there's any for-profit argument by the Treasury against Tornado Cash. But for what it's worth, the smart contract is still live on the Ethereum mainnet. Given that it is immutable, it is not possible to take it down. It's also trivial to fork and I imagine several forks already exist on mainnet and across various EVM forks by now.

Potentially you are challenging one of the world's largest governments to find a way to stop it. I dunno what they can or what they will do but imagine this scenario: they sanction it in a way that you are guilty of money laundering if a copy is found on your computer -- now running the Ethereum mainnet or any fork that contains it is illegal in the United States. Do not think the DoJ won't. Refer https://xkcd.com/538/ or James Mickens' https://www.usenix.org/system/files/1401_08-12_mickens.pdf for some hilarious hard truth on what happens when cryptographic research meets a real world government agency. Also refer the old saying "never wake a sleeping lion".

> you are guilty of money laundering if a copy is found on your computer -- now running the Ethereum mainnet or any fork that contains it is illegal in the United States

This is well beyond the regulatory and legal powers of the U.S. Treasury and the DOJ. That is not the letter of the law with regards to money laundering, and the agency cannot invent new laws out of thin air. Nor can they blanket ban a technology or code just because they have to learn new stuff. Could Congress pass such a law? Sure, but even then, we'll go to the mats in the court and in state legislatures. Nevermind that criminalizing and demonizing a large portion of the population hurts your re-election chances.

Even torrenting, as egregious as the copyright abuse was in Pirate Bay's heyday, was never banned in such a way. Email scams from Nigeria never necessitated the shutdown of email. VPNs continue to operate.

Nevermind that similar cases with regards to cryptography have already gone to court, which ruled in favor of speech: https://www.eff.org/deeplinks/2015/04/remembering-case-estab...

The XKCD example is amusing, but fails even the most basic cross-examination. Surely officers with a court-issued warrant for probable cause of a crime should be able to inspect a person's home or things. Maybe they could find a private key written on a post-it note somewhere in the person's home. That's all fair and good, and no one is arguing against that. Clearly, it's not very scalable, nor should it be. We operate under the presumption of innocence in free societies.

We all have a problem with illegal, abusive, mass surveillance. It is a violation of human liberty and a disturbing trend that has to be pushed against to prevent a full-on dystopian, authoritarian hellscape where you don't even have paper cash as an outlet from the panopticon. To avoid that future outcome, to preserve the freedom of your children, you have to fight for privacy and transactional liberty. My ancestors were willing to bleed and die for liberty. Some of us still are, today. Never wake a sleeping lion, indeed.

Unprofitable money laundering operations collapse from the costs of meeting demand at scales large enough to offend the United States government, and so require no special prosecution or censure in order to fail. Cryptocoin laundering is highly desired by those that would launder currency, and so is not exempt from this outcome.

Immutable smart contracts on blockchains are available to anyone with the few dollars worth of ether or other base chain currency necessary to execute the contract on-chain. They do not cost anything to operate after being deployed. In that sense, Tornado Cash is a protocol, that has more in common with HTTPS than with a business operation. Smart contracts can be thought of as software-defined protocols. Given that HTTPS and other forms of encryption are used on the regular, for both good and nefarious purposes, I see no reasonable argument against mixers. There has to be a path for on-chain privacy. It is a human right. It's also a U.S. constitutionally protected 4th amendment human right.

Whatever their benefits, mixers also enable and support the laundering of illegally-obtained currency and the circumvention of government sanctions. These points are both reasonable arguments against mixers. It remains to be seen whether society as a whole will accept your argument that mixers are an innate human right, protected under the constitution.

However, I observe with these sanctions that both the US judiciary and those of many others countries has decided cryptocoin laundering is not a protected human right, due to the balance of harm caused to societies outweighing the rights of the individual. It’s your right here in the US to declare that they’re wrong, but I do not see in your reply any new evidence or arguments presented that would change the course of the US government.

I think David Gerard summarises nicely here [1]:

> If the ether is proceeds from a crime, then this is literally just money laundering.

> There’s also this weird delusion that if you put some dirty money in a box with clean money and shake it, then it all comes out as clean — and not that it all comes out as dirty.

> The bad takes were all variations of the fundamental fallacy of cryptocurrency: that you can code your way around the rules of society.

1: https://davidgerard.co.uk/blockchain/2022/08/09/us-sanctions...

> There’s also this weird delusion that if you put some dirty money in a box with clean money and shake it, then it all comes out as clean — and not that it all comes out as dirty.

That's the exact take that brought to closure of tornado.cash. If you start with two distinct piles and at the end you only get one some-of-these-might-be-dirty pile, the solution to this is to destroy the mixer, not to sift through bank notes. The reason why we don't consider everything that has touched dirty money to be tainted is explicitly to protect people who may have been inadvertently brought into it.

Taking down a more public side to it (tornado.cash) has the effect of restraining the type of users that will now use it. Instead of privacy zealots (10%), money launderers (20%) and random users (70%) (numbers mostly pulled out of my ass for demonstration purposes), by making it only accessible to a much more select audience, you'll basically lose most of the random users. And believe me, if the US Treasury sanctioned it because 20% of the money going through was laundering (and the other 80% making it much harder to trace), when 66% of your traffic becomes money laundering, not only will they sanction harder, but they will also start going after actual people.

Touching the tornado cash contract is a poison pill right now.

I agree, but GitHub is going out of their way to censor this code, and developers in other countries are being arrested for writing it. Maybe a high profile case of "the code will remain available" will dissuade those who intend to follow suit.

This isn't the first time smart cryptographers have forced an issue like this. He wants the government to threaten GitHub and him with a lawsuit, and they have to sue him in court (which the government wants to avoid as they have a significant chance of losing). Like Clipper and Bernstein v. US, where EFF was involved.

exactly this. Microsoft will always heel to the short leash of US sanctions because the losses for them are tangible: billions in government contracts.

gitlab isn't bought and paid for, so forcing the issue only stands to win them PR with hackers.

> Microsoft will always heel to the short leash of US sanctions because the losses for them are tangible: billions in government contracts.

You seem to be under the impression that "the government" is a monolitic beast that all operates together.

There are other parts of government that would like nothing more than to see OFAC get a bloody nose over this (eg, other agencies that believe they should be the ones regulating crypto).

He republished it on GitHub: https://github.com/tornado-repositories

More commonly, these are simply different matters, and the different parts of Government that handle them don't care.

Even more generally, governments ruled by laws do not care in the sense that they do not, as a system, carry grudges and the like. A government contract is awarded by tender, for which there are rules. And unless you have exactly the same people handling two issues, there's just no mechanism for any interest to bend the rules to be transmitted from one group of people to the other.

There are sometimes cracks in this system, but even those are somewhat formalized: "buy American" rules, for example. There are also rules that apply to government contractors but not businesses operating in the private sector exclusively, such as higher minimum wages, enhanced environmental protection, or union requirements. The reason here is that these can be instituted by the executive alone, without the legislative.

But punishing a single company just because they're taking an issue to court? That'd be consider rather corrupt. It's also silly: there are thousands of lawsuits between governments and private businesses every year. Every single Fortune 500 is probably involved in a few dozens at any given time.

Indeed, I think this is a even more accurate characterization of how government actually works.

Microsoft owns GitHUB and you're talking about GitLAB and those are different things.

correct indeed, my bad. I've been in gitlab all weekend

Gitlab has a number of government contracts including, for example, with the NSA.

Why github?? Didn't SFC quit github and urged other open source projects to do the same? This is so odd.

Because it was hosted on GitHub initially, and they took it down. There's clearly a protest angle here, and it'll be interesting to watch this play out.

Reply on news.ycombinator.com