4 ms·

By that logic why haven’t the developers of Metasploit also been arrested? It’s hard to argue that the behavior of the software isn’t/couldn’t be used for nefar

By that logic why haven’t the developers of Metasploit also been arrested? It’s hard to argue that the behavior of the software isn’t/couldn’t be used for nefarious purposes and to commit crimes. Anonymizing spending on it’s own is not a crime. Clearly the line is crossed if the developer is promoting the use of the software for illegal purposes. I’m only vaguely familiar with Tornado cash, was that the case? If not, how do we as a society/community draw the line on determining a developers intentions?

Sebb767 4y ago
> Anonymizing spending on it’s own is not a crime. Money laundering laws very much disagree with this.
- Ferrotin 4y ago
  Money laundering laws in the U.S. require some other crime to be involved.
- agotterer 4y ago
  I’m not familiar with the money laundering laws. But do they state that you can’t buy something anonymously and without an audit trail? Because spending legally obtained cash seems anonymous to me. Is anonymizing your digital spend with legally obtained capital that different?
  - Sebb767 4y ago
    I can't speak for the US, but in Germany, transactions between countries over 10k€ must be reported to the Bundesbank. There are similar limits for inner-country transactions with businesses, especially financial ones. I assume the USA has similar rules. So small cash transaction are fine, but as soon as larger sums are involved it's going to be very problematic. Since crypto currencies, nearly by definition, don't care about country borders and the mixers don't trace the amount put in by each user, they almost certainly allow you to circumvent money laundering registration requirements. It's even worse if they frame the mixer as financial institution, in which case it directly violates its reporting requirements.
    - aaaaaaaaata 4y ago
      > It's even worse if they frame the mixer as financial institution Where do they?
    - agotterer 4y ago
      These are fair points and I believe there are similar laws in the US.
phphphphp 4y ago
Software doesn’t come to be through immaculate conception: the authors created it, knowing it could be used in this way. If a company releases software that is used nefariously, there are very common legal actions to hold them accountable. For example, Facebook has extensive legal obligations to meet to do with behaviour on their platform. I am not arguing that tornado cash should be illegal (or that encryption should be illegal) rather I am arguing that people are responsible for the software they have created. If I commit a crime, my intent is absolutely a part of the equation when determining legal action. Why should it be any different with software? If you wish to argue that the right to privacy is so great that it exceeds any risk of criminal activity, and thus the developers of tornado cash were doing something for the greater good, so be it (that’s probably the position I would take) but it doesn’t absolve them of responsibility. Taken to the extreme, if I build a piece of software that can save the lives of murder victims by killing the murderer: I am responsible for the killing of (intended) murderers. We might decide that the activity is justified, that the software is operating for the greater good and is therefore permissible, but that doesn’t change my responsibility.
- ziddoap 4y ago
  >I am arguing that people are responsible for the software they have created. So, is your answer to the asked question yes, the developers of Metasploit should be arrested and jailed? How about the developers of Bitlocker? It's used to encrypt illegal content, impeding police discovery efforts. Every person who developed a file-sharing website should probably also be arrested. Lots of illegal/pirated/etc. content out there. The point being that almost every software on the planet can potentially used for malicious and illegal activities. Seems like if we indefinitely held developers responsible for what other people do with their software, the smart person would never develop any software.
  - phphphphp 4y ago
    Law isn’t a binary based on responsibility, it’s reductive to suggest that by arguing for responsibility we are also arguing for prison for software developers. I can be responsible for your death and spend no time in prison. Every other industry deals with this challenge — why should software be any different?

Sebb767 4y ago

> Anonymizing spending on it’s own is not a crime. Money laundering laws very much disagree with this.

Ferrotin 4y ago
Money laundering laws in the U.S. require some other crime to be involved.
agotterer 4y ago
I’m not familiar with the money laundering laws. But do they state that you can’t buy something anonymously and without an audit trail? Because spending legally obtained cash seems anonymous to me. Is anonymizing your digital spend with legally obtained capital that different?
- Sebb767 4y ago
  I can't speak for the US, but in Germany, transactions between countries over 10k€ must be reported to the Bundesbank. There are similar limits for inner-country transactions with businesses, especially financial ones. I assume the USA has similar rules. So small cash transaction are fine, but as soon as larger sums are involved it's going to be very problematic. Since crypto currencies, nearly by definition, don't care about country borders and the mixers don't trace the amount put in by each user, they almost certainly allow you to circumvent money laundering registration requirements. It's even worse if they frame the mixer as financial institution, in which case it directly violates its reporting requirements.
  - aaaaaaaaata 4y ago
    > It's even worse if they frame the mixer as financial institution Where do they?
  - agotterer 4y ago
    These are fair points and I believe there are similar laws in the US.

phphphphp 4y ago

Software doesn’t come to be through immaculate conception: the authors created it, knowing it could be used in this way. If a company releases software that is used nefariously, there are very common legal actions to hold them accountable. For example, Facebook has extensive legal obligations to meet to do with behaviour on their platform. I am not arguing that tornado cash should be illegal (or that encryption should be illegal) rather I am arguing that people are responsible for the software they have created. If I commit a crime, my intent is absolutely a part of the equation when determining legal action. Why should it be any different with software? If you wish to argue that the right to privacy is so great that it exceeds any risk of criminal activity, and thus the developers of tornado cash were doing something for the greater good, so be it (that’s probably the position I would take) but it doesn’t absolve them of responsibility. Taken to the extreme, if I build a piece of software that can save the lives of murder victims by killing the murderer: I am responsible for the killing of (intended) murderers. We might decide that the activity is justified, that the software is operating for the greater good and is therefore permissible, but that doesn’t change my responsibility.

ziddoap 4y ago
>I am arguing that people are responsible for the software they have created. So, is your answer to the asked question yes, the developers of Metasploit should be arrested and jailed? How about the developers of Bitlocker? It's used to encrypt illegal content, impeding police discovery efforts. Every person who developed a file-sharing website should probably also be arrested. Lots of illegal/pirated/etc. content out there. The point being that almost every software on the planet can potentially used for malicious and illegal activities. Seems like if we indefinitely held developers responsible for what other people do with their software, the smart person would never develop any software.
- phphphphp 4y ago
  Law isn’t a binary based on responsibility, it’s reductive to suggest that by arguing for responsibility we are also arguing for prison for software developers. I can be responsible for your death and spend no time in prison. Every other industry deals with this challenge — why should software be any different?