Hacker News Reader

Comment by dannyw | Hacker News Reader

That's interesting. As a Tornado Cash user, I have never associated this with an intentional money laundering service, but rather a bunch of developers advancing zk-SNARKs and other cryptographic primitives.

As someone who was excited by the original Bitcoin whitepaper back in 2011, zk-SNARKS was what excited me about cryptocurrency again in 2021.

View on HN

Your association isn't what regulators are concerned with. They're concerned with the intent of the creator and operator of the service, which is why he's the one who's been arrested.

And you're buying into propaganda suggesting someone pushing the envelope in cryptography is creating tooling specifically for money laundering. 30 years ago, the NSA toed a similar line in their war on PGP, saying it was used in practice for "money laundering, child pornography, and terrorism" - https://reason.com/video/2020/10/21/cryptowars-gilmore-zimme...

For the umpteenth time in this thread: intent matters. Regardless of what the NSA said 30 years ago, it is manifestly apparent to every single person in this conversation that neither HTTPS nor PGP nor any other cryptographic scheme designed for individual privacy was designed with money laundering in mind.

At the absolute worst, they were agnostic to the presence of criminal activity. This is in contrast to Tornado Cash, which was repeatedly told that their service was being used to launder money.

So if the developers of PGP were told that ISIL was using their service to facilitate terrorism should they shut down the project?

What project? PGP was bundled up and thrown onto the Internet; there was no development or services community established around it. The US Government threw a hissy fit over that and they ended up distributing it as a "book" instead, converting it into a question of free expression.

There is no meaningful sense in which PGP could ever be said to "facilitate" terrorism in the same way that Tornado Cash is rightfully characterized as facilitating money laundering. PGP is a program that runs on your host, encrypting your email. Tornado Cash is a service, run by an individual who was warned to cease serving sanctioned entities, and failed to do so.

Ignoring the front-end (which is unnecessary to use it), Tornado Cash is a protocol, run by a decentralized network of computers. The code for the protocol is shared by a network of computers execute this code according to specific rules and validate transactions. A specific deployment of the code was sanctioned, but this means anyone else using the code (which has to be deployed to this network to be used trustlessly) is risky to use now

> Tornado Cash is a service, _run by an individual_ who was warned to cease serving sanctioned entities, and failed to do so.

This is false. The (vast majority of the) Tornado Cash contracts were either deployed to Ethereum as immutable contracts, or updated in 2020 to revoke mutability (once the final zkSNARK parameters were included) [0], meaning that they could not later be updated by the user(s) that deployed them. Arguing that Tornado Cash is run by an individual means arguing that the entire Ethereum network is run by an individual. There was no way for a warned individual to comply with that warning.

[0] https://www.coincenter.org/education/advanced-topics/how-doe... - Section titled "Can Tornado Cash be removed or updated? If so, by whom?"

>The (vast majority of the) Tornado Cash contracts

Thousands of little contracts doesn't absolve a financial institution from a few many-billion dollar illegal transfers, especially after they've been warned repeatedly.

What do you mean by "thousands of little contracts"? I haven't looked at Tornado's source code too much, it's entirely possible there are additional contracts created by their contracts as part of the protocol, but this would be pretty unusual.

Usually a smart contract protocol is a set of contracts working together, deployed to the blockchain, which provide application logic that executes regardless of who is interacting with it (via "transactions")

Thousands of different private keys doesn't absolve a corporation from billions of illicit conversations, especially after they have been warned repeatedly.

Well it probably was, among other things. But we're censoring a network here, not just a tool. Nobody is making the cryptography behind Tornado illegal.

The open source software and cryptographic protocol is implicitly targeted with this order. You can see it in how private companies are now handling the Tornado Cash code and contributor accounts. If you create a similar privacy tool with zk-SNARKs do you really think it won’t also become a target for sanctions in time?

This is known as “chilling effect” in a legal context.

To expand on this, the chilling effect here is that even if the code behind tornado cash isn't explicitly illegal, using it on a blockchain in practice is incredibly risky.

People who might otherwise want to use this for financial privacy would be wary, since if they deposit funds to the contract, they don't have any way to know if they'll be able to use the unlinked funds later if withdrawn.

> have never associated this with an intentional money laundering service

Most customers of a canonical money launderer, a laundromat, don’t realise it’s a front. That doesn’t matter if the owner is laundering money.

Tornado laundered money for North Korea [1]. (It announced this months before the sanctions, a period in which the developers could have reacted but didn’t [EDIT: in any meaningful way].) That it was also obfuscating legitimate flows is frankly irrelevant.

[1] https://www.bloomberg.com/news/articles/2022-08-08/crypto-mi...

What could the developers have done?

> What could the developers have done?

Not sure. Their problem. If the only option was shutting it down, that. It would have looked better, which could have prompted sympathetic legislation. At the very least, it would have likely avoided sanctions.

You can’t just say “they had months to react but didn’t” if you don’t have any idea of what they could have done differently. React how?

Close down until you figured out a way to react. Money laundering is serious crime, helping North Korea is as well. Tornado cash did apparently both, and authorities gave them a heads up. If it was me, I would close my shop down.

It cannot be shut down. The contract is immutable. It's still live, and it will still be live for decades to come, with new duplicates of the contract being published every day.

> It cannot be shut down. The contract is immutable.

If that’s truly the case, shut down as in stop developing it and advise users to stop using it. Then the addresses get sanctioned and nobody is surprised.

You can't reasonably expect a random commenter to have full insight into their legal situation. They should have talked to their lawyers and found options. There is a chance that their financial service is incompatible with the laws in some jurisdictions, and so they might not be able to do business in those jurisdictions. Financial services are heavily regulated...

I think you’re confused about the facts of the situation here. There was no financial service being operated. There was no ongoing business. There was open source code that was thrown over the wall and was locked on the blockchain and immutable.

This is incorrect. Tornado devs blocked all OFAC addresses from accessing the frontend, which is the only power they had, since the contracts themselves are immutable. See https://www.coindesk.com/tech/2022/04/15/tornado-cash-adds-c...

> Tornado devs blocked all OFAC addresses from accessing the frontend, which is the only power they had, since the contracts themselves are immutable

Which does nothing in practice. Any AML lawyer would have advised them so. The fact that the service was designed to be incompatible with the law isn’t a get-out-of-jail card.

What would you say about Signal, designed to be incompatible with the law around lawful subpoenas?

> What would you say about Signal, designed to be incompatible with the law around lawful subpoenas?

It’s not. Subpoenas require handing over what you have. If you don’t have it there is no obligation to disclose. Signal may run afoul of data-retention laws. But there are no such requirements in America.

I read the lawsuit in question. None of the plaintiffs were arrested. Their issue is that OFAC overstepped the bounds of their statutory authority, which none of your arguments address.

I'm also not aware of what US law would have been violated by either

1. Coding and publishing the tornado source code

2. Deploying several instances to the blockchain in 2019.

There's no US prosecutions based on creating or operating tornado. The Dutch one has not charged the person they arrested yet, according to https://www.coindesk.com/policy/2022/08/24/alleged-tornado-d..., so I don't know what unlawful actions they think he's responsible for.

> issue is that OFAC overstepped the bounds of their statutory authority, which none of your arguments address

Plaintiffs' argument relies on Tornado Cash not being "a person, entity, or organization" [1]. The complaint declares OFAC exceeded its statutory authority, but provides no specifics. (The code cited in ¶ 9 [2] gives courts the authority to tell agencies not to do bad things. That isn't an argument for or against OFAC's specific actions in this case.)

In summary, it's a hope-and-a-prayer complaint. Maybe someone at OFAC fucked up the paperwork, thereby giving rise to some modicum of relief.

[1] https://storage.courtlistener.com/recap/gov.uscourts.txwd.11... ¶ 4

[2] https://www.law.cornell.edu/uscode/text/5/706

Reply on news.ycombinator.com