10 ms·

This is the crux of the issue in my opinion. It seems ridiculous that the sanctions should apply retroactively to anyone who has dealt with a sanctioned entity

This is the crux of the issue in my opinion. It seems ridiculous that the sanctions should apply retroactively to anyone who has dealt with a sanctioned entity at any time in the past - if the people contributed before the sanctions, they were not contributing to a “blocked person”, as the project was not blocked at the time. Imagine if, say, A foreign electronics company is sanctioned by the government - does this mean that anyone who has previously worked with them or bought their electronics has done so illegally? If so, that sounds like a significant impediment to commerce, since nobody can predict who will be sanctioned in the future.

withinboredom 4y ago
A government can pretty much do whatever it wants in the realm of foreign relations, things it can't usually do to it's citizens (such as retroactively applying sanctions). If you have a problem with it, take it up with the government.
nuclearnice1 4y ago
I agree with your analysis. Ex post facto criminal laws are barred by the constitution for good reason. Retroactive punishment leaves people guessing what actions might or might not be punished.
- PeterisP 4y ago
  Well, Github blocking an account is not considered "punishment" according to criminal law or constitution, only standard contract law would apply and I believe Github has the right to terminate such contracts if they wish. This consideration would apply if and only if the government would actually pursue criminal charges against someone who contributed to TornadoCash - which they possibly would if someone would do stuff after these sanctions e.g. try to circumvent this GitHub block, make and advertise a replacement service, etc; do not do this if US laws apply to you.
  - mananaysiempre 4y ago
    > Github blocking an account is not considered "punishment" according to criminal law or constitution I understand this to be the case. I don’t understand how anyone considers this to be even remotely sane.
    - junon 4y ago
      Sanctions are orders to cease providing service, aid, goods or funding. Which part is unclear?
  - oliwary 4y ago
    I agree - GitHub can block whoever they want. But doing so despite not being required to by law is a valid reason to criticize them.
    - blagie 4y ago
      No. I disagree. Github should not be able to block anyone they want. We went through this about a century ago with railways, antitrust, and Standard Oil. I won't step through the details, but can provide more background if anyone cares. We landed with the concept of a "common carrier." Railways, as well as telecommunications companies, ISPs, public airlines, bus lines, taxicab companies, phone companies, cruise ships, motor carriers, freight companies, and others CANNOT discriminate. As an individual or a small business, ones does not have an alternative to Microsoft Word, github, or Facebook. If these companies are allowed to discriminate, we'd be in a position where, again, monied entities can shut down individual small businesses, or ostracize individuals, as they see fit. Once you provide a sufficiently central service, you should not be allowed to discriminate.
      - jakelazaroff 4y ago
        > As an individual or a small business, ones does not have an alternative to - Microsoft Word — Google Docs? Apple Pages? Zoho Docs? OpenOffice? - GitHub — GitLab? sourcehut? Bitbucket? Gitea? - Facebook — Twitter? Instagram? TikTok? SnapChat? The thing about Git is that it's free software. Anyone can run their own server for very little money. If you get banned from the railroad, you can't just get your own train.
- itsoktocry 4y ago
  >Ex post facto criminal laws are barred by the constitution for good reason. I think your analysis is flawed. They didn't come up with some new law and apply it to these people ex post facto. These accounts were contributing to the money laundering (per accusations, albeit indirectly). Another way to look at it: if these people were contributing knowingly to a project that was laundering money, should they be punished? Of course.
  - thalassophobia 4y ago
    This is a anonymous token. It can be used for a plethora of things, including earning passive income. If we apply this line of thinking, everyone who has ever contributed to Monero and Tor should be punished because both are widely used for criminal activity.
  - nuclearnice1 4y ago
    I agree with this analysis. If they are being punished for money laundering committed in the past while money laundering was illegal, that’s good enforcement. If they are being punished for previous lawful contribution to an entity that was in the future sanctioned, that’s bad enforcement.
- deleted 4y ago
  [deleted]
oliwary 4y ago
Unless, of course, GitHub considers every single contributor to Tornado to be part of the sanctioned entity due to the decentralized nature of git? Seems like a very dangerous interpretation for open source in that case…
- yrro 4y ago
  If you really want to lose some sleep look up partnership law. Everyone who has ever contributed to an open source project _could_ be (in the absence of the project setting up proper legal structures) considered a membership of a general partnership, and thereby become jointly and severally subject to unlimited liability for the actions of the partnership. (IANAL this is just what I've read online)
  - jaywalk 4y ago
    IANAL either, but I have taken business law courses. And what you said is simply not true. At all.
  - jsty 4y ago
    I think it would be a fairly novel interpretation of "persons carrying on a business in common with a view to profit" required to catch out contributors to an open source project. Outside of a project that takes contributions / donations without a legal entity to receive them and parcels those out amongst the contributors, I can't think of a reasonable situation that would enable such a definition.
    - yrro 4y ago
      Seems unlikely to me too but that's what I've read. If you ask a lawyer "what are the risks of doing X" they'll give you a list, and some will be more likely than others. It's up to the client to decide what level of risk they're happy with. I managed to dig up the mailing list thread where I read about this risk: https://groups.google.com/g/linux.debian.vote/c/Nl-J8h2pO9A/m/npmD0t-jBwAJ https://groups.google.com/g/linux.debian.vote/c/Nl-J8h2pO9A/...; for context, Sam Hartman is a former Debian Project Leader and I assume his opinion is formed by advice from SPI's lawyers.
bad416f1f5a2 4y ago
> Imagine if, say, A foreign electronics company is sanctioned by the government - does this mean that anyone who has previously worked with them or bought their electronics has done so illegally? If so, that sounds like a significant impediment to commerce, since nobody can predict who will be sanctioned in the future. That's not what's happening here. What you're seeing is a US company evaluating its ongoing business relationships, and making the decision that continuing to associate with principals of a designated company isn't worth any potential legal risk.
Jamesbeam 4y ago
Your perspective on this is distorted. We are talking about an entity that according to the treasury has laundered more than 7 Billion USD, assisted criminals and neglected complying to Anti-Money Laundering/Countering the Financing of Terrorism (AML/CFT) obligations willingly and repeatedly. Tornado Cash has repeatedly failed to impose effective controls designed to stop it from laundering funds for malicious cyber actors, regularly and without basic measures to address its risks. This according to the treasury goes on for years since its creation, so everyone who actively contributed to the entity is considered a threat to national security and often, if you look at the sanctions list of OFAC sanctioned entities, rightfully so. Retroactively, and to my knowledge, there is not a single investigation and OFAC sanction that got lifted by a court because the accusations themselves were wrong. And it's not like you don't have the right to appeal those sanctions. Entities and sanctioned people quite often do so, and fail. See https://www.cadc.uscourts.gov/internet/judgments.nsf/C2B2FFF8D0E2D21985258814004F12B9/$file/21-5157-1940976.pdf https://www.cadc.uscourts.gov/internet/judgments.nsf/C2B2FFF... for example. Tornado Cash is not just a foreign electronics company that stumbled into an OFAC sanction because it accidentally sold a Toaster to Kim Jong-un, so he can enjoy a crispy morning toast. Where you are right is, that OFAC sanctions are a significant impediment to commerce because you cannot predict who will be sanctioned in the future. That's why, as a company or even individual, you need to do due diligence on who you get in business with. If you import fruits and someone gives you 5k per box of Avocados extra to import them from Mexico to the US asap, you can bet there are not just Avocados in those boxes. You can pretend you didn't know, but if you don't want to end up in jail for providing service to a cartel, you need to make sure there are only Avocados in those boxes and the premium is for extra fast shipping. Everyone knows that virtual currency mixers are commonly used by illicit actors to launder funds, especially those stolen during significant heists. This is at least common knowledge since the Silk Road days. So if you contribute to such a project, that has the potential to harm your fellow citizens and contribute to financing of terrorism, without making sure it is complying to Anti-Money Laundering/Countering the Financing of Terrorism (AML/CFT) obligations one hundred percent, you can't just cry foul play and say I didn't know anything of this. Especially if you understand code and the inner workings of said project or have a direct line to the people in charge if you frequently contribute. So, in my opinion it's more than ok if everyone who contributed to Tornado Cash and enabling it to do what it is accused of, their life should turn to sh*t immediately and everything they touch from here on. Because getting people harmed or financing terrorism or foreign state actors is not a trivial offense. Laundering virtual currency for criminals hurts real people.
giancarlostoro 4y ago
> Imagine if, say, A foreign electronics company is sanctioned by the government - does this mean that anyone who has previously worked with them or bought their electronics has done so illegally? My understanding of the American justice system says you cannot do this, our founding fathers did not want any witch hunts, laws should deter future abuse, otherwise people might as well never do anything, ever.
miohtama 4y ago
Sanctions do not apply retroactively, so this is overreach on Microsoft’s behalf. However Microsoft is a private business and can choose whom they do not business with. This is not protected by freedom of speech or any legal right.
lr4444lr 4y ago
It's called covering your ass. Github/MS need to protect themselves, which means taking all actions reasonably possible to fend off charges of obstruction or collusion.
lallysingh 4y ago
https://docs.github.com/en/site-policy/acceptable-use-policies/github-acceptable-use-policies#1-compliance-with-laws-and-regulations https://docs.github.com/en/site-policy/acceptable-use-polici... I think this is probably an AUP question. The sanctions are a big enough "hey these users broke the law" signal.
JumpCrisscross 4y ago
> seems ridiculous that the sanctions should apply retroactively Anyone contributing to Tornado after it became public knowledge that it was used to launder money put themselves at risk. The sanctions are the enforcement action. A wanted poster. The crime, laundering money, was committed a while ago. > does this mean that anyone who has previously worked with them or bought their electronics has done so illegally? If you knew they were doing sanctionable things, yes. If you didn’t, no.
- throwaway290 4y ago
  What is not used to launder money? What separates pre-sanctions Tornado from any other tech that can feasibly be used for something evil (e.g. cash money, PayPal, any cryptocurrency, e2ee messengers)? Should we ask the government to publish a registry of approved technologies to ensure own safety?
  - JumpCrisscross 4y ago
    > What separates pre-sanctions Tornado from any other tech that can feasibly be used for something evil (e.g. cash money, PayPal, any cryptocurrency, e2ee messengers)? I don’t have the technical answer. But from the instant tumblers became a thing everyone with AML experience saw the endgame. It’s providing, as a service, a function directly analogous to real-world layering. It does nothing else. And nobody involved seems to have taken the prospect of criminals using their product seriously. Messengers are not money, so laundering goes out the window. PayPal is regulated. And crypto does other things. Tornado just served to hide the origin of money. And it was used to launder illegally-gotten gains.
    - throwaway290 4y ago
      I do not see a meaningful difference between e2ee messengers and mixers. Both aim to support anonymity. Both can (and do) enable bad things. If you (unlike me) believe that cryptocurrency should be legal, I don't see why you would think mixers should not. Now it is moot after sanctions are in effect. What we are discussing is mental world model of software engineers before Tornado sanctions were announced and their accounts wiped. It might be hard to see in hindsight.

withinboredom 4y ago

A government can pretty much do whatever it wants in the realm of foreign relations, things it can't usually do to it's citizens (such as retroactively applying sanctions). If you have a problem with it, take it up with the government.

nuclearnice1 4y ago

I agree with your analysis. Ex post facto criminal laws are barred by the constitution for good reason. Retroactive punishment leaves people guessing what actions might or might not be punished.

PeterisP 4y ago
Well, Github blocking an account is not considered "punishment" according to criminal law or constitution, only standard contract law would apply and I believe Github has the right to terminate such contracts if they wish. This consideration would apply if and only if the government would actually pursue criminal charges against someone who contributed to TornadoCash - which they possibly would if someone would do stuff after these sanctions e.g. try to circumvent this GitHub block, make and advertise a replacement service, etc; do not do this if US laws apply to you.
- mananaysiempre 4y ago
  > Github blocking an account is not considered "punishment" according to criminal law or constitution I understand this to be the case. I don’t understand how anyone considers this to be even remotely sane.
  - junon 4y ago
    Sanctions are orders to cease providing service, aid, goods or funding. Which part is unclear?
- oliwary 4y ago
  I agree - GitHub can block whoever they want. But doing so despite not being required to by law is a valid reason to criticize them.
  - blagie 4y ago
    No. I disagree. Github should not be able to block anyone they want. We went through this about a century ago with railways, antitrust, and Standard Oil. I won't step through the details, but can provide more background if anyone cares. We landed with the concept of a "common carrier." Railways, as well as telecommunications companies, ISPs, public airlines, bus lines, taxicab companies, phone companies, cruise ships, motor carriers, freight companies, and others CANNOT discriminate. As an individual or a small business, ones does not have an alternative to Microsoft Word, github, or Facebook. If these companies are allowed to discriminate, we'd be in a position where, again, monied entities can shut down individual small businesses, or ostracize individuals, as they see fit. Once you provide a sufficiently central service, you should not be allowed to discriminate.
    - jakelazaroff 4y ago
      > As an individual or a small business, ones does not have an alternative to - Microsoft Word — Google Docs? Apple Pages? Zoho Docs? OpenOffice? - GitHub — GitLab? sourcehut? Bitbucket? Gitea? - Facebook — Twitter? Instagram? TikTok? SnapChat? The thing about Git is that it's free software. Anyone can run their own server for very little money. If you get banned from the railroad, you can't just get your own train.
itsoktocry 4y ago
>Ex post facto criminal laws are barred by the constitution for good reason. I think your analysis is flawed. They didn't come up with some new law and apply it to these people ex post facto. These accounts were contributing to the money laundering (per accusations, albeit indirectly). Another way to look at it: if these people were contributing knowingly to a project that was laundering money, should they be punished? Of course.
- thalassophobia 4y ago
  This is a anonymous token. It can be used for a plethora of things, including earning passive income. If we apply this line of thinking, everyone who has ever contributed to Monero and Tor should be punished because both are widely used for criminal activity.
- nuclearnice1 4y ago
  I agree with this analysis. If they are being punished for money laundering committed in the past while money laundering was illegal, that’s good enforcement. If they are being punished for previous lawful contribution to an entity that was in the future sanctioned, that’s bad enforcement.
deleted 4y ago
[deleted]

oliwary 4y ago

Unless, of course, GitHub considers every single contributor to Tornado to be part of the sanctioned entity due to the decentralized nature of git? Seems like a very dangerous interpretation for open source in that case…

yrro 4y ago
If you really want to lose some sleep look up partnership law. Everyone who has ever contributed to an open source project _could_ be (in the absence of the project setting up proper legal structures) considered a membership of a general partnership, and thereby become jointly and severally subject to unlimited liability for the actions of the partnership. (IANAL this is just what I've read online)
- jaywalk 4y ago
  IANAL either, but I have taken business law courses. And what you said is simply not true. At all.
- jsty 4y ago
  I think it would be a fairly novel interpretation of "persons carrying on a business in common with a view to profit" required to catch out contributors to an open source project. Outside of a project that takes contributions / donations without a legal entity to receive them and parcels those out amongst the contributors, I can't think of a reasonable situation that would enable such a definition.
  - yrro 4y ago
    Seems unlikely to me too but that's what I've read. If you ask a lawyer "what are the risks of doing X" they'll give you a list, and some will be more likely than others. It's up to the client to decide what level of risk they're happy with. I managed to dig up the mailing list thread where I read about this risk: https://groups.google.com/g/linux.debian.vote/c/Nl-J8h2pO9A/m/npmD0t-jBwAJ https://groups.google.com/g/linux.debian.vote/c/Nl-J8h2pO9A/...; for context, Sam Hartman is a former Debian Project Leader and I assume his opinion is formed by advice from SPI's lawyers.

bad416f1f5a2 4y ago

> Imagine if, say, A foreign electronics company is sanctioned by the government - does this mean that anyone who has previously worked with them or bought their electronics has done so illegally? If so, that sounds like a significant impediment to commerce, since nobody can predict who will be sanctioned in the future. That's not what's happening here. What you're seeing is a US company evaluating its ongoing business relationships, and making the decision that continuing to associate with principals of a designated company isn't worth any potential legal risk.

Jamesbeam 4y ago

Your perspective on this is distorted. We are talking about an entity that according to the treasury has laundered more than 7 Billion USD, assisted criminals and neglected complying to Anti-Money Laundering/Countering the Financing of Terrorism (AML/CFT) obligations willingly and repeatedly. Tornado Cash has repeatedly failed to impose effective controls designed to stop it from laundering funds for malicious cyber actors, regularly and without basic measures to address its risks. This according to the treasury goes on for years since its creation, so everyone who actively contributed to the entity is considered a threat to national security and often, if you look at the sanctions list of OFAC sanctioned entities, rightfully so. Retroactively, and to my knowledge, there is not a single investigation and OFAC sanction that got lifted by a court because the accusations themselves were wrong. And it's not like you don't have the right to appeal those sanctions. Entities and sanctioned people quite often do so, and fail. See https://www.cadc.uscourts.gov/internet/judgments.nsf/C2B2FFF8D0E2D21985258814004F12B9/$file/21-5157-1940976.pdf https://www.cadc.uscourts.gov/internet/judgments.nsf/C2B2FFF... for example. Tornado Cash is not just a foreign electronics company that stumbled into an OFAC sanction because it accidentally sold a Toaster to Kim Jong-un, so he can enjoy a crispy morning toast. Where you are right is, that OFAC sanctions are a significant impediment to commerce because you cannot predict who will be sanctioned in the future. That's why, as a company or even individual, you need to do due diligence on who you get in business with. If you import fruits and someone gives you 5k per box of Avocados extra to import them from Mexico to the US asap, you can bet there are not just Avocados in those boxes. You can pretend you didn't know, but if you don't want to end up in jail for providing service to a cartel, you need to make sure there are only Avocados in those boxes and the premium is for extra fast shipping. Everyone knows that virtual currency mixers are commonly used by illicit actors to launder funds, especially those stolen during significant heists. This is at least common knowledge since the Silk Road days. So if you contribute to such a project, that has the potential to harm your fellow citizens and contribute to financing of terrorism, without making sure it is complying to Anti-Money Laundering/Countering the Financing of Terrorism (AML/CFT) obligations one hundred percent, you can't just cry foul play and say I didn't know anything of this. Especially if you understand code and the inner workings of said project or have a direct line to the people in charge if you frequently contribute. So, in my opinion it's more than ok if everyone who contributed to Tornado Cash and enabling it to do what it is accused of, their life should turn to sh*t immediately and everything they touch from here on. Because getting people harmed or financing terrorism or foreign state actors is not a trivial offense. Laundering virtual currency for criminals hurts real people.

giancarlostoro 4y ago

> Imagine if, say, A foreign electronics company is sanctioned by the government - does this mean that anyone who has previously worked with them or bought their electronics has done so illegally? My understanding of the American justice system says you cannot do this, our founding fathers did not want any witch hunts, laws should deter future abuse, otherwise people might as well never do anything, ever.

miohtama 4y ago

Sanctions do not apply retroactively, so this is overreach on Microsoft’s behalf. However Microsoft is a private business and can choose whom they do not business with. This is not protected by freedom of speech or any legal right.

lr4444lr 4y ago

It's called covering your ass. Github/MS need to protect themselves, which means taking all actions reasonably possible to fend off charges of obstruction or collusion.

lallysingh 4y ago

https://docs.github.com/en/site-policy/acceptable-use-policies/github-acceptable-use-policies#1-compliance-with-laws-and-regulations https://docs.github.com/en/site-policy/acceptable-use-polici... I think this is probably an AUP question. The sanctions are a big enough "hey these users broke the law" signal.

JumpCrisscross 4y ago

> seems ridiculous that the sanctions should apply retroactively Anyone contributing to Tornado after it became public knowledge that it was used to launder money put themselves at risk. The sanctions are the enforcement action. A wanted poster. The crime, laundering money, was committed a while ago. > does this mean that anyone who has previously worked with them or bought their electronics has done so illegally? If you knew they were doing sanctionable things, yes. If you didn’t, no.

throwaway290 4y ago
What is not used to launder money? What separates pre-sanctions Tornado from any other tech that can feasibly be used for something evil (e.g. cash money, PayPal, any cryptocurrency, e2ee messengers)? Should we ask the government to publish a registry of approved technologies to ensure own safety?
- JumpCrisscross 4y ago
  > What separates pre-sanctions Tornado from any other tech that can feasibly be used for something evil (e.g. cash money, PayPal, any cryptocurrency, e2ee messengers)? I don’t have the technical answer. But from the instant tumblers became a thing everyone with AML experience saw the endgame. It’s providing, as a service, a function directly analogous to real-world layering. It does nothing else. And nobody involved seems to have taken the prospect of criminals using their product seriously. Messengers are not money, so laundering goes out the window. PayPal is regulated. And crypto does other things. Tornado just served to hide the origin of money. And it was used to launder illegally-gotten gains.
  - throwaway290 4y ago
    I do not see a meaningful difference between e2ee messengers and mixers. Both aim to support anonymity. Both can (and do) enable bad things. If you (unlike me) believe that cryptocurrency should be legal, I don't see why you would think mixers should not. Now it is moot after sanctions are in effect. What we are discussing is mental world model of software engineers before Tornado sanctions were announced and their accounts wiped. It might be hard to see in hindsight.