The Legit Ledger Podcast Ep. 10
Government Overreach on Blockchain Tech? The Tornado Cash Lawsuit with Christopher Bosch and Zack Golda
Thank you for downloading this transcript.
Listen to the original podcast released October 18, 2022 here: https://www.sheppardmullin.com/multimedia-426
In this episode of The Legit Ledger, Sheppard Mullin attorneys Christopher Bosch and Zack Golda join host Yasamin Parsafar to discuss the Tornado Cash lawsuit, which claims the OFAC exceeded its authority by prohibiting U.S. citizens from interacting with the crypto mixer.
Guests:
About Yasamin Parsafar
Yasamin Parsafar is a partner with the Intellectual Property Practice Group in Sheppard Mullin’s San Francisco office, where she serves as co-leader of the firm’s Blockchain & Fintech team. Her practice focuses on protecting her clients’ intellectual property rights through counseling, prosecution, enforcement, and litigation. Yasamin leverages her litigation experience to strengthen and protect her clients’ intellectual property, manage risks, and position businesses to succeed in the event of a dispute. She frequently advises and protects brands venturing into web3 on various issues related to non-fungible tokens, metaverses, games, online marketplaces, and other platforms.
About Christopher Bosch
As an associate in the Governmental Practice Group in Sheppard Mullin’s New York office, Christopher Bosch primarily focuses on Securities regulation, compliance, and litigation, as well as internal investigations and white collar defense. He frequently represents banks, broker-dealers, investment advisers, boards of directors, corporate officers, financial advisors and other securities professionals in connection with internal investigations and inquiries by the U.S. Attorney’s Offices for the Southern District of New York and Northern District of California, the SEC, the CFTC, FINRA, the IRS, the FRB, the NY Department of Financial Services.
Christopher advises financial institutions on compliance with data privacy and cybersecurity legal mandates, and represented a blockchain investor in connection with shareholder derivative and class actions alleging securities law violations. He also advises firms regarding digital token issuances and regulatory compliance, and regularly publishes on regulatory developments in the cybersecurity, blockchain and cryptocurrency spaces.
About Zack Golda
Zack Golda is an associate in Sheppard Mullin’s Business Trial Practice Group in the Orange County, California office, where he primarily focuses on general business litigation, including regulatory challenges, breach of contract, business torts, blockchain, sports and other high-stakes business litigation matters. As a member of the firm’s Blockchain Industry Group, Zack has litigated cases involving blockchain, privacy, and regulatory issues. He has also drafted several articles about regulatory advances in the cryptocurrency space, covering topics such as decentralized autonomous organizations (DAOs), and SEC and CFTC regulation of the blockchain industry.
Zack also is a member of the California Regulatory Practice Group, where he advises clients on communicating with regulators, analyzing and responding to agency proposed rulemakings and, where necessary, litigating constitutional, statutory, and procedural challenges to newly passed regulations.
Transcript:
Yasamin Parsafar:
Hi friends. Welcome to another episode of The Legit Ledger. I'm Yasamin Parsafar, the co-leader of Shepard Mullen's Blockchain Team. I want to thank you all for joining and ask that if you enjoyed this content to please subscribe and share with your friends. We really appreciate that and it gives us motivation to continue to produce this content.
On today's episode, we're going to be discussing the Tornado Cash lawsuit. Joining us today we have Chris Bosch and Zack Golda of Sheppard Mullin's Blockchain Team. Chris is a senior associate in the firm's governmental practice group. His practice primarily focuses on financial industry, regulation, enforcement, and litigation. Zack is an associate in the business trials group focusing on complex business litigation and constitutional claims. Zack and Chris, thank you both for joining us today.
Zack Golda:
Thank you, Yas.
Chris Bosch:
Thanks for having us.
Yasamin Parsafar:
All right. Before jumping into the lawsuit; Chris, can you give us a high level explanation of what Tornado Cash is for those who are not familiar?
Chris Bosch:
Sure. So Tornado Cash is what's known as a cryptocurrency mixer, and a cryptocurrency mixer generally allows a user to deposit their crypto in a pool and then withdraw that crypto from the pool in a way that detaches the transaction history from that crypto.
Yasamin Parsafar:
Okay. And this lawsuit was filed in response to government action and specifically the Office of Foreign Assets Control, or OFAC, adding Tornado Cash to the Specially Designated Nationals And Blocked Persons List, also known as the SDN list. Can you explain, Chris, what it means to be on the SDN list and what was OFAC's reasoning for adding Tornado Cash to the SDN list?
Chris Bosch:
So generally speaking, when an entity is placed on the SDN list, the funds held by that entity are blocked or frozen. So if you have funds with a blocked entity, those may be considered blocked assets and blocked assets typically need to be reported to OFAC. Individuals are also prohibited from transacting with the party that's been designated for the SDN list. And engaging in a prohibited transaction with that party is considered a strict liability offense, meaning you theoretically break the law by virtue of the transaction itself. You don't need to intend to break the law. And engaging with prohibited transactions with parties on the SDN list can also result in significant civil and criminal penalties.
Yasamin Parsafar:
So why did OFAC add Tornado Cash to the SDN list? What was its reasoning for doing that?
Chris Bosch:
Right. So according to OFAC, Tornado Cash has been used since its inception in 2019 to launder more than 7 billion worth of virtual currency, including funds that OFAC says were stolen by a North Korean hacking group and through other crypto heists. So the thinking here is that it's been shown that in the past, Tornado Cash has been used to launder illicit funds and they then go on to say that Tornado Cash has not implemented appropriate controls to prevent that from happening in the future. So as a result, essentially, it's necessary that OFAC takes steps to sanction it to prevent these kinds of laundering of illicit funds in the future.
Yasamin Parsafar:
But the name of the SDN list itself implies that it's intended for blocking transactions with nationals and people. And Tornado Cash is a technology, right? It's code. So are you aware of any other situation where a technology has been on the SDN list?
Chris Bosch:
Right, so that's the really interesting thing about this case. So in its press release, OFAC actually calls Tornado an entity. And I'm not sure if that's just a product of maybe OFAC using some boilerplate language that it uses for these press releases, but really that's up for debate. And as we get into it, I think we'll see one of the main cruxes of the complaint against the Treasury and against OFAC is that Tornado Cash is not an entity, but is source code or software. And I'm not aware of another situation in which interacting with software has itself been sanctioned. And I think what we might be witnessing here are laws revolving around centralized systems meeting a new decentralized reality. And I think that out of that intersection comes this fascinating case.
Yasamin Parsafar:
So it seems like OFAC's reasoning, which is basically that people should not be allowed to use this technology because it can be used to conduct illegal activity, or in some cases has been used to do so, that because of that nobody should be allowed to use the technology. And that seems like it could create a very dangerous precedent. So speaking of which, let's jump into the lawsuit. Chris, can you tell us who are the plaintiffs in this case and what claims are they bringing in general?
Chris Bosch:
Sure. So as we've already mentioned, on August 8th, 2022, OFAC sanctioned Tornado Cash, which is as we mentioned, a digital currency mixer, and placed it on this SDN list. About a month later, six plaintiffs filed a complaint against the Treasury Department, OFAC, Treasury Secretary Yellen, and OFAC director Andrea Gacki in the United States District Court for the Western District of Texas. And in this case, they're seeking declaratory and injunctive relief. They are asking the court to declare that OFAC’s addition of Tornado Cash to the SDN list was unlawful. And they're also asking the court to permanently enjoin the enforcement of the designation and any sanctions stemming therefrom. So the key question that's being asked here is can OFAC sanction technology such as open source code rather than specific individuals or entities? And it's interesting. The plaintiffs that are bringing this case, they all have experience in the crypto industry, they all have technology experience, whether it be in their profession or in their business endeavors.
So you have kind of a sophisticated pool of investors here that I think are going to present a compelling case and make very compelling arguments. In terms of the arguments that are being presented in the complaint itself, there's three separate counts. So the first count is being brought under the Administrative Procedure Act, specifically 5 U.S.C., section 706(2)(A) and (C). And the argument under this provision is that OFAC’s designation of Tornado Cash was not in accordance with law, and OFAC exceeded its statutory authority in sanctioning Tornado Cash in this way. The argument is that the president has delegated OFAC the authority under the International Emergency Economic Powers Act, or IEEPA, to regulate certain activities involving quote, "Any property in which any foreign country or a national thereof has any interest by any person or with respect to any property subject to the jurisdiction of the United States." The claim here that plaintiffs are bringing is that Tornado Cash is neither property nor a foreign country or a national nor a person.
So as distinguished from another entity against which the treasury issued sanctions, blender.io, that entity had a centralized authority. It was operating under a centralized structure and that entity was sanctioned for allegedly enabling North Korean money laundering as well. But here, Tornado Cash is not that. Tornado Cash is open source code that doesn't operate under a centralized control. So therefore, according to these plaintiffs as they're presenting in the complaint, Tornado Cash is not subject to OFAC's regulatory authority. The second count stems from the First Amendment and the Administrative Procedure Act and asserts that OFAC sanctions constitute a prohibition on protected speech under the First Amendment. The primary idea, and I believe we'll talk a little bit more about this later on in our discussion, is that the privacy offered by Tornado Cash allows engagement in socially valuable speech.
For example, one of the plaintiffs in this case made donations to Ukraine in connection with the Russia war against Ukraine. And there's obviously an interest in protecting your privacy when you're engaging in such speech. So the idea here is that by blanket sanctioning the technology, you are also prohibiting certain kinds of valuable speech in that regard. And also Tornado Cash can provide for valuable business opportunities, entrepreneurial opportunities, innovative opportunities through the technology, through its capabilities. It can facilitate people transacting with one another to enable those kinds of opportunities.
And the third count is brought under the due process clause of the Fifth Amendment and the Administrative Procedure Act. The claim here is that three of the plaintiffs had their Ether trapped by the sanctions without any due process prior to that deprivation, let alone any due process of law. And as we mentioned earlier, when something is sanctioned, its assets are blocked or frozen. So the claim here is that if you have assets in Tornado Cash, you are now not allowed to transact to get it out of Tornado Cash without theoretically violating the sanctions.
Yasamin Parsafar:
Wow.
Chris Bosch:
So the claim being brought here is that this is unjustified by any national security interest and is thus contrary to constitutional rights. So those are the three counts that plaintiffs are bringing. That's who they are. That's kind of the spirit of the case. And if you'd like, I can also get into some developments that happened subsequently, specifically OFAC published certain FAQs on its website that seem to speak directly to these counts. So I don't know if that's something you'd like me to get into.
Yasamin Parsafar:
Yeah, I think that would be helpful. I do think the privacy issue is extremely important here. And what you said about the donations to the Ukraine too I thought was really interesting. And we know that Vitalik Buterin also tweeted that he had used the technology for the same purpose. So really interested to see how that plays out. But yes, please do tell us about the FAQs that were released.
Chris Bosch:
Yeah, so it's interesting. Shortly after the suit was filed, OFAC issued several new FAQs in the category of cyber related sanctions, but they all relate to Tornado Cash. And when you look at the FAQs, it looks like they're attempting to speak to some of the claims here. And so I'll just run through several of them. So the first one is FAQ 1076, and essentially what they're saying is that copying the code, making it available online and including it in publication is generally constitutes permissible activities. So they're kind of touching on some aspects theoretically of the free speech argument that's being brought. They're not exactly hitting the nail on the head, but you can tell that's what they're trying to get at, I think. FAQ 1076 says that when an individual is dusted... So dusting is when someone on an unsolicited basis sends cryptocurrency to your wallet, and that can happen without those funds being requested.
Now, if somebody were to know the wallet of somebody, it's actually happened to celebrities recently, if you know a person's wallet address, you can theoretically dust them crypto through Tornado Cash. And by doing that, that person has now received, at least theoretically, funds from a sanctioned quote, unquote "entity". I put that in air quotes because whether or not it's an entity is very much up for debate. And when that happens, that could also potentially raise an obligation of the person who received those funds to report the receipt of those funds, because they could be construed as blocked assets.
So it creates an interesting situation where somebody now has all of a sudden accrued these obligations without having even requested the funds themselves in the first place. So what OFAC has said in this FAQ is that, while technically people receiving dusted funds through Tornado Cash are required to report it, they are not going to prioritize enforcement against those individuals. So they're not saying that you're not legally required to report it, they're just saying that for now you're towards the bottom of a theoretical list of enforcement priorities. But I'm not sure how much consolation that provides.
And then the next one, FAQ 1079 provides a method for users whose digital assets have been trapped by the sanctions to seek a license from treasury to recover them. And OFAC noted specifically that they would have a favorable licensing policy towards such applications. So this is kind of speaking to the concept of not being able to get your assets out of Tornado Cash, but whether or not that resolves the question I think is also remains to be seen. I think that there is probably arguments that could be made that that doesn't necessarily totally address the due process concerns that are raised in the complaint. So what effect these FAQs may have on the lawsuit, if any, remains to be seen. But clearly they seem to be trying to at least nibble around the edges of some of these claims and maybe get out ahead of things to lessen the fallout against them. But it's an interesting choice by them to do that and we'll just have to see how it all plays out.
Yasamin Parsafar:
Right. Thank you for that, Chris.
Zack, can you explain how technology like Tornado Cash can be protected under the First Amendment?
Zack Golda:
Certainly. So with the rise of the internet, we've seen a vast number of technologies that are all based on communication and regulating these types of technologies involves regulating communication itself and speech itself. So in that sense, Tornado Cash is just a set of instructions existing on the Ethereum network or wherever else it's published. And any user can come execute those instructions to obtain the desired result of disconnecting their transaction history from their cryptos, as Chris described earlier. So this is speech for a couple reasons. There's the very first obvious reason that Tornado Cash is an actual set of written down code somewhere that exists and that itself is speech by definition. However, there's also the functional aspects of the code. It's code that's executed. So it also functions like conduct in some ways. And so when Chris was talking about the FAQ addressing whether publishing the Tornado Cash code was prohibited under the sanctions, they're speaking directly to that first layer argument of whether this is speech because prohibiting publishing the code would certainly violate the First Amendment almost without doubt.
But by taking that off the table, OFAC's trying to limit themselves to only impacting the actual conduct and not the speech. And that's important under the First Amendment because the typical analysis is if a regulation targets speech because of its content, we call it content-based, and those content-based laws are basically presumptively unconstitutional. They receive strict scrutiny and the government has to justify the regulation with a compelling purpose, compelling government interest. And typically these are national security, or the COVID-19 pandemic was a compelling government interest, and it has to be narrowly tailored to assist to further that government interest. And that means that the fit has to be really, really tight. That means that there has to be no other way for the government to accomplish this goal without this kind of infringement on speech. So it has to be a very important goal and a very tight, as minimal as possible, infringement on speech. That's what OFAC is up against in this First Amendment context.
And additionally, with the licensing scheme mentioned in the FAQs as well, that might raise another key First Amendment issue, which is a prior restraint. And prior restraints on speech are actually the only thing in all of constitutional law that gets more strict than strict scrutiny. They are just presumed unconstitutional and typically they are found in the context of injunctions—so a court maybe enjoining publication of an article would be a prior restraint—or in licensing schemes. And so that's why I mentioned the FAQs because the reference to a licensing scheme could raise a prior restraint argument here.
Yasamin Parsafar:
So Zack, you mentioned that based on the FAQs, it seems OFAC's position is going to be that it's regulating conduct and not speech. So let's just assume for the sake of discussion that they were to win that argument. That doesn't resolve the First Amendment issues, right? So can you tell us a little bit more about that?
Zack Golda:
Right. So there's a long line of precedent beginning with a very famous case, United States v. O'Brien, which is the case that people like to tell stories of where someone was burning their draft card for the Vietnam draft on the courthouse steps, and they did that to express their displeasure with the draft, with the war, their unwillingness to fight in the war in their protest against the draft essentially. The court held that there was an expressive element to that conduct there, but in itself the regulations prohibiting people from destroying their or altering their draft cards did not target that conduct... Or that speech. That expressive element of the conduct, excuse me. And because the law did not target the expressive element, it was allowed to stand. And there's a test that courts employ. It's been refined in cases like Rumsfeld v. The Forum for Academic and Institutional Rights.*
And basically if there is a law that is generally applicable and it prohibits certain conduct but has an incidental effect on expression. And so in the draft card case it would be, "I don't like the war." In here it would be, "I want to maintain some anonymity in my blockchain financial dealings," would be the expressive element of the conduct tied to Tornado Cash. And in that case, the court has to apply intermediate scrutiny. So slightly less important government justifications may still be sufficient. So you don't necessarily need a national security risk to justify a law, but then you still need a good fit. It still has to be narrowly tailored to protect the government's interest in stopping the conduct affected without overly burdening the expression of that conduct. And it's still honestly a fairly uphill battle for the government to defend those cases if the court believes that the conduct is truly expressive.
In the context of code, there are several cases that have held that open source software is constitutionally protected. So Junger v. Daley out of the Second Circuit and Bernstein out of the Ninth Circuit, those both held that code is speech and merits protection under the First Amendment despite its expressive elements. However, on the other side of the scale, there are several cases analyzing a software called DeCSS, which allowed people to remove copyright protections from DVDs and allow them to be copied and distributed freely. And courts have held that that kind of code can be restricted and government can prohibit people from linking or instructing people how to download and use that DeCSS code because it directly violated the other technological protections that were built into the DVDs. It was basically a code that all it did was undo those protections. There was no other expressive element to it.
And so here I think you kind of got a middle ground where this conduct that OFAC is regulating is actually inherently expressive because what it's doing is just removing the link between your old wallet and your new wallet or some set of funds that you no longer want to express to the public on the publicly available blockchain network. And because I think it targets that inherent expressive element—OFAC's regulation targets the desire to maintain some anonymity, which is directly the expressive element of using Tornado Cash—that I think that the court would apply intermediate scrutiny in that scenario.
Yasamin Parsafar:
And it seems like, if the standard is that it needs to be narrowly tailored, it seems like blocking use of a technology or code in its entirety is not narrowly tailored to anything. So one can think of many situations where various products or services have been used to in furtherance of illegal activity. And this just seems like it could be extremely broad. So curious to see how that turns out.
Chris Bosch:
I'd also just like to add that what you have here is essentially problematic conduct from the First Amendment perspective. And you have that coupled with potentially OFAC exceeding its statutory authority. So you have this fascinating element about whether or not this is painting far too broad a brush under either the strict scrutiny analysis or the intermediate scrutiny analysis, but then you also have that with maybe a government agency acting outside of its statutory authority. So I think when you couple that it can paint a fairly compelling image of government overreach on two different levels into a certain right that is obviously very importantly enshrined in this country.
So I think that the package in which this First Amendment conversation comes with regard to the grounds upon which OFAC is asserting to actually even take this action, being a bit shaky. And I'm sure that plaintiffs are going to argue very shaky. And I think there's an argument there. I just think that that context also adds another intriguing element to this case.
Zack Golda:
Agreed. But here's one wrinkle though, is that on the narrowly tailored issue, specifically Yasamin brought up, the OFAC could argue, "Hey, we're only prohibiting access to one anonymizer, or on-chain anonymizer. We're not prohibiting access to all of them. And so in that way our rule is narrowly tailored, because our evidence shows that the terrorists, the North Korean Lazarus group, they're using Tornado Cash, they're not using the other ones, and we only targeted Tornado Cash." And so I think if that argument does come up, it'll be really important to get back to First Amendment principles and just point out that not only is OFAC targeting this one quote, unquote "entity", it also has a chilling effect of making other people in society not want to pursue this same conduct or these similar technologies. And that chilling effect is extremely important under the First Amendment.
Chris Bosch:
I was just thinking this press release seems to indicate that OFAC had some means of determining that funds were used by a North Korean hacking group and they also mention two heists that were carried out by other groups in 2022. So I mean that would imply a means of knowing when illicit actors are transacting. We don't have insight in terms of how exactly they determine that, but if they are capable of doing that in some way, then I think that that could undermine the argument that what they're doing here by implementing a broad based restriction on anybody interacting with it because they simply can't filter out the good people from the bad people. I think it would be interesting to know, well then how did you come to know that bad people were using it in the first place? And if that capability exists, how can you say that this sweeping sanction, this sweeping action, is sufficiently tailored to achieve a government interest? So that could be an interesting facet. We could see how that plays out.
So Zack, I had one more question for you. Earlier I had talked about how there's this dusting aspect to this situation. That somebody could send unsolicited crypto to a wallet through Tornado Cash, and by virtue of that, the recipient would be theoretically receiving blocked assets and that could invoke various reporting obligations and potentially some kind of an enforcement action. And I was just wondering if you see any kind of First Amendment implications with regard to the dusting aspect?
Zack Golda:
Well, certainly. It's interesting that you bring that up because the dusting transactions, essentially it's giving any third party who knows your wallet address the ability to make you a criminal, subject to a reporting requirement to OFAC. And the OFAC FAQs are very clear that they're not taking you off the enforcement list, they're just putting you at the end. So it still gives you that criminal status. And under a First Amendment case called Reno, there's discussion in that case about online chat rooms and indecent conversation. And there was a rule that would prohibit people from discussing basically adult, sexual topics if there was a minor who had identified themself in the chat room.
And the court held that the First Amendment could not condone a law that would basically allow anyone to go into an online chat room, say, "Hey, I'm not 18 years old," and censor the conversation happening there. Here with Tornado Cash's dusting, by allowing people to use Tornado Cash to dust well known wallets... And as you mentioned earlier, this has happened to celebrities and even mini-celebrities, podcasters I listen to in the crypto space, it happened to them.
And this is what's called a heckler's veto under the First Amendment. And so anyone who doesn't like what someone's talking about and knows their wallet address can essentially go force them to report money to OFAC whenever they want and as many times as they want. And each time the person would have to file a new report and go through the administrative process with OFAC. And I really do believe that that heckler's veto aspect of this case raises serious First Amendment concerns. Because think about it this way; what if the FBI wanted to know the identity of a certain wallet address, they could just use Tornado Cash and essentially force that person to come report that information to the government. I mean, where's the constitutional protection of our rights in that situation? They just don't exist.
Chris Bosch:
Wow. Very interesting. Yeah, thanks a lot for that.
Yasamin Parsafar:
There's a lot going on here and we're definitely going to be following this. So I think we will probably have a follow up episode on this at some point for further discussion. So thank you guys both for joining, and thank you to all of our listeners today. We really appreciate you. If you have any Web3 legal needs, please don't hesitate to reach out. Also, if you would like to be a guest on our show or have topic suggestions, we would love to hear from you on that as well. Our contact information is linked below. And that's it for this week. Thank you so much, and we look forward to having you again next time.
Resources:
Announcement of Sanctions Against Tornado Cash
Contact Information:
* * *
Thank you for listening! Don’t forget to FOLLOW the show to receive every new episode delivered straight to your podcast player every week.
If you enjoyed this episode, please help us get the word out about this podcast. Rate and Review this show in Apple Podcasts, Amazon Music, Google Podcasts, Stitcher or Spotify. It helps other listeners find this show.
Be sure to connect with us and reach out with any questions/concerns:
This podcast is for informational and educational purposes only. It is not to be construed as legal advice specific to your circumstances. If you need help with any legal matter, be sure to consult with an attorney regarding your specific needs.