8 ms·

How many people here on HN have submitted a PR that criminals could use to do bad things? Security tools, encrypted messaging, jailbreaking tools, VPNs, file h

How many people here on HN have submitted a PR that criminals could use to do bad things? Security tools, encrypted messaging, jailbreaking tools, VPNs, file hosting tools, anonymity tools...etc. The complaint itself cites 'writing instructions on how to use a VPN' as evidence that the developers were knowingly doing something criminal. A VPN! You might hate crypto and believe that open source private money is different than open source private messaging. But that is not what the government's ability to jail these developers hinges on. Any argument prosecutors are making here could be made (and in many countries has been made) about any of the tools I list above. To cheer this on is to throw the past 40 years of legal advocacy around privacy, encryption, and anticensorship tools in the trash.

deleted 3y ago
[deleted]
jshen 3y ago
You can't cherry pick that out of context, criminal indictments often cite things that can be ordinary. Buying duct tape isn't a crime, but it can be evidence of a kidnapping. As far as I can tell these people created a business to profit off of money laundering, and they were helping teach people how to hide their identity.
- holmesworcester 3y ago
  Yes. We agree completely on the facts here. These people built a business to profit off the provision of online privacy, and as part of they were helping teach people how to preserve their online privacy. Some people used their tool for money laundering, just as some people have surely used encrypted messaging and VPNs for theft, terrorism, child abuse, and other crimes. The point is that online privacy always has significant legitimate, non-criminal use cases, and developers can have legitimate, non-criminal (noble, even) reasons for building for those use cases. And the larger point is that, if we want to have tools that give us any meaningful online privacy, we must stand up for the developers that build such tools when they are (inevitably, perennially) accused of aiding criminals and terrorists.
  - JohnFen 3y ago
    The government is going to make the case not that a tool was made that could be used for money laundering, but that a tool was made to intentionally allow for money laundering. The former is not illegal, the latter is. But regardless of intentions, not following KYC/AML rules is illegal.
    - mschuster91 3y ago
      > But regardless of intentions, not following KYC/AML rules is illegal. KYC/AML rules are of questionable legitimacy themselves, IMHO. With less and less of society allowing to pay in anonymous currency (i.e. cold hard cash), either because it's dropped for "security" (i.e. shop owners don't want to pay for security to make sure the cash ain't stolen) or because of legal requirements (see e.g. Italy limiting cash transactions to 5.000€ in value, or Germany requiring a notification if you pay more than 10.000€ in value for a car), and many people moving to card payments due to convenience, there will be no way to escape the dragnet of governmental and private surveillance as all bank accounts are identifiable per KYC/AML regulations and virtually all banks report all account holders to Equifax and the other credit bureaus so to find out where a person banks is only a subpoena or a hack away. Oh, and completely forget about hiding legal but still sensitive payments: sex work of all kinds, political engagement, everything becomes yet another line in a trove of data lakes. And that doesn't even touch the subject of card processing fees. Mastercard and Visa are rent-seekers of the worst kind, and no one seems to be willing to break them up or cap their fees, with PayPal close behind. Instead, everyone looks away when they cave to Evangelical pressure campaigns and drop sex workers left and right. KYC/AML regulations deserve to be torn apart, and the people deserve privacy in their lives. Or, alternatively, we should force elected officials to open up their bank accounts to the public. If we can't have privacy, they certainly don't deserve it either.
      - JohnFen 3y ago
        You're making an argument about what the law should be. In many ways, I'm very sympathetic to those arguments. But that's not what the law is, and law enforcement agencies as well as the court system only deal with what the law actually is. You can (and should!) agitate and work towards changing the law to be more in line with what you think is right. That's the sort of change that is entirely possible in our system. But until then, the law is what the law is.
kasey_junk 3y ago
If the government has records that you wrote a service that specifically violates the law, that you contemplated a change that would make it compliant but didn’t because your customers won’t use it, they are right to charge you with a crime. I’m a privacy advocate, who thinks kyc laws have gone too far. But if you knowingly break a law you can’t cite the unjustness of that law unless you are engaged in an act of civil disobedience. Profits will suffer is not civil disobedience.
- holmesworcester 3y ago
  When Signal becomes illegal in, say, the UK, will you support the extradition of Signal developers to the UK simply because they're knowingly breaking the law? At what point does it matter what's right?
  - woodruffw 3y ago
    What about the GP's comment implies that they support extraditing people to foreign countries?
  - lolinder 3y ago
    Signal is threatening to leave jurisdictions where they become illegal rather than comply. They're not threatening to keep operating in violation of the law.
    - miracle2k 3y ago
      What does "leaving a jurisdiction" mean? Can Tornado Cash "leave the US jurisdiction" as well and will then be left alone? Will you support the UK if they ask for the extradition of Signal developers, on the basis that say Signal will continue to have UK users accessing their service? Where are your values?
      - KptMarchewa 3y ago
        > What does "leaving a jurisdiction" mean? Can Tornado Cash "leave the US jurisdiction" as well and will then be left alone? You can - by not being inside the US, doing proper KYC and rejecting US customers.
deleted 3y ago
[deleted]
lolinder 3y ago
> The complaint itself cites 'writing instructions on how to use a VPN' as evidence that the developers were knowingly doing something criminal. A VPN! Do you have a link and paragraph number for this quote? I searched in the press release [0] and OCR'd the indictment [1] and can't find any match to any part of that quote ("VPN", "writing", or "instructions"). I also can't find any match for that quote anywhere on Google. [0] https://www.justice.gov/usao-sdny/pr/tornado-cash-founders-charged-money-laundering-and-sanctions-violations https://www.justice.gov/usao-sdny/pr/tornado-cash-founders-c... [1] https://www.justice.gov/media/1311391/dl?inline https://www.justice.gov/media/1311391/dl?inline
- polygamous_bat 3y ago
  > The complaint itself cites 'writing instructions on how to use a VPN' as evidence that the developers were knowingly doing something criminal. A VPN! As if the modus oparendi of sketchy crypto sites wasn't shouting off the rooftops "You can't use this site cause we detected a US IP we don't do business with US citizens. BTW, here's how to use a VPN!"
arp242 3y ago
They didn't "just" send a PR or "just" write some code, they made a financial tool which earned them millions while ignoring regulations for these type of financial tools. No one who sent a PR was arrested or even investigated: just the people running Tornado. This has been pointed out time and time again. Crypto wants to be taken serious as a financial tool. Okay, fine. This also means you have to follow the same rule as anyone else. Don't like these rules? Fine, you're allowed to – we have a democratic process for changing that so go vote, lobby, etc. Remember the 2008 banking crisis? There are reasons these regulations exist. Banks get fined for these types of things all the time too: https://duckduckgo.com/?t=ffab&q=bank+fined+money+laundering&ia=web https://duckduckgo.com/?t=ffab&q=bank+fined+money+laundering... – crypto isn't being singled out here. If you knowingly ignore the laws for personal profit you can expect consequences like this. Cryptopeople want to live in some sort of magical fantasy world where they both want to interact with real money and the financial markets when it suits them, but also pretend specific laws and rules for it don't apply to them when they're inconvenient. All while they're lining their pockets of course. Maybe this world has unicorns and dragons and teletubbies too.
- miracle2k 3y ago
  > They didn't "just" send a PR or "just" write some code, they made a financial tool which earned them millions while ignoring regulations for these type of financial tools. No one who sent a PR was arrested or even investigated: just the people running Tornado. This has been pointed out time and time again. Since TC is still running with both guys in jail, they clearly weren't "running it" - but the Ethereum node operators are. Should they be arrested? Are you answering this question as a laywer, or as citizen engaged in the democratic process telling me what you feel the law should be?
  - arp242 3y ago
    They were developing it and making money from it, so that's "running it" by all but the most boring pedantic definition. Ethereum is a protocol and a tool, which Tornado used it to knowingly profit from illegal transactions. Ethereum is somewhat akin (not identical) to USD, and Tornado somewhat akin to a bank operating with USD outside of the law. I was unaware I need to get a university law degree before commenting here.
celtoid 3y ago
It's a far cry from what some members of the tech community did when the government was trying to restrict code and cryptography in the 1990s. People were tattooing perl scripts onto their bodies in order to protest the restrictions. God forbid people break the law to protest bad laws. "How to become an Arms Trafficker Become an Arms-Trafficker in one easy step with this great way to register your protest of ITAR by Vince Cate. Just click to submit the form and join in the protest. Lots of excellent links. Have you exported RSA today? Includes an option to email a protest letter to US president." [0] [0] http://www.cypherspace.org/adam/rsa/ http://www.cypherspace.org/adam/rsa/
- JohnFen 3y ago
  > It's a far cry from what some members of the tech community did when the government was trying to restrict code and cryptography in the 1990s. So? All that means is that there were people who thought that was a just fight and don't think that this is a just fight. > God forbid people break the law to protest bad laws. That's a legitimate form of protest and I won't condemn it. But when you break a law out of protest, you are still subject to arrest and prosecution for doing that. And often, that's the result you actively want because it brings attention to your cause and gives you a platform to argue the injustice in court. That said, it doesn't look to me like the accused here were engaging in civil disobedience. It looks like they were pursuing profit.

deleted 3y ago

[deleted]

jshen 3y ago

You can't cherry pick that out of context, criminal indictments often cite things that can be ordinary. Buying duct tape isn't a crime, but it can be evidence of a kidnapping. As far as I can tell these people created a business to profit off of money laundering, and they were helping teach people how to hide their identity.

holmesworcester 3y ago
Yes. We agree completely on the facts here. These people built a business to profit off the provision of online privacy, and as part of they were helping teach people how to preserve their online privacy. Some people used their tool for money laundering, just as some people have surely used encrypted messaging and VPNs for theft, terrorism, child abuse, and other crimes. The point is that online privacy always has significant legitimate, non-criminal use cases, and developers can have legitimate, non-criminal (noble, even) reasons for building for those use cases. And the larger point is that, if we want to have tools that give us any meaningful online privacy, we must stand up for the developers that build such tools when they are (inevitably, perennially) accused of aiding criminals and terrorists.
- JohnFen 3y ago
  The government is going to make the case not that a tool was made that could be used for money laundering, but that a tool was made to intentionally allow for money laundering. The former is not illegal, the latter is. But regardless of intentions, not following KYC/AML rules is illegal.
  - mschuster91 3y ago
    > But regardless of intentions, not following KYC/AML rules is illegal. KYC/AML rules are of questionable legitimacy themselves, IMHO. With less and less of society allowing to pay in anonymous currency (i.e. cold hard cash), either because it's dropped for "security" (i.e. shop owners don't want to pay for security to make sure the cash ain't stolen) or because of legal requirements (see e.g. Italy limiting cash transactions to 5.000€ in value, or Germany requiring a notification if you pay more than 10.000€ in value for a car), and many people moving to card payments due to convenience, there will be no way to escape the dragnet of governmental and private surveillance as all bank accounts are identifiable per KYC/AML regulations and virtually all banks report all account holders to Equifax and the other credit bureaus so to find out where a person banks is only a subpoena or a hack away. Oh, and completely forget about hiding legal but still sensitive payments: sex work of all kinds, political engagement, everything becomes yet another line in a trove of data lakes. And that doesn't even touch the subject of card processing fees. Mastercard and Visa are rent-seekers of the worst kind, and no one seems to be willing to break them up or cap their fees, with PayPal close behind. Instead, everyone looks away when they cave to Evangelical pressure campaigns and drop sex workers left and right. KYC/AML regulations deserve to be torn apart, and the people deserve privacy in their lives. Or, alternatively, we should force elected officials to open up their bank accounts to the public. If we can't have privacy, they certainly don't deserve it either.
    - JohnFen 3y ago
      You're making an argument about what the law should be. In many ways, I'm very sympathetic to those arguments. But that's not what the law is, and law enforcement agencies as well as the court system only deal with what the law actually is. You can (and should!) agitate and work towards changing the law to be more in line with what you think is right. That's the sort of change that is entirely possible in our system. But until then, the law is what the law is.

kasey_junk 3y ago

If the government has records that you wrote a service that specifically violates the law, that you contemplated a change that would make it compliant but didn’t because your customers won’t use it, they are right to charge you with a crime. I’m a privacy advocate, who thinks kyc laws have gone too far. But if you knowingly break a law you can’t cite the unjustness of that law unless you are engaged in an act of civil disobedience. Profits will suffer is not civil disobedience.

holmesworcester 3y ago
When Signal becomes illegal in, say, the UK, will you support the extradition of Signal developers to the UK simply because they're knowingly breaking the law? At what point does it matter what's right?
- woodruffw 3y ago
  What about the GP's comment implies that they support extraditing people to foreign countries?
- lolinder 3y ago
  Signal is threatening to leave jurisdictions where they become illegal rather than comply. They're not threatening to keep operating in violation of the law.
  - miracle2k 3y ago
    What does "leaving a jurisdiction" mean? Can Tornado Cash "leave the US jurisdiction" as well and will then be left alone? Will you support the UK if they ask for the extradition of Signal developers, on the basis that say Signal will continue to have UK users accessing their service? Where are your values?
    - KptMarchewa 3y ago
      > What does "leaving a jurisdiction" mean? Can Tornado Cash "leave the US jurisdiction" as well and will then be left alone? You can - by not being inside the US, doing proper KYC and rejecting US customers.

deleted 3y ago

[deleted]

lolinder 3y ago

> The complaint itself cites 'writing instructions on how to use a VPN' as evidence that the developers were knowingly doing something criminal. A VPN! Do you have a link and paragraph number for this quote? I searched in the press release [0] and OCR'd the indictment [1] and can't find any match to any part of that quote ("VPN", "writing", or "instructions"). I also can't find any match for that quote anywhere on Google. [0] https://www.justice.gov/usao-sdny/pr/tornado-cash-founders-charged-money-laundering-and-sanctions-violations https://www.justice.gov/usao-sdny/pr/tornado-cash-founders-c... [1] https://www.justice.gov/media/1311391/dl?inline https://www.justice.gov/media/1311391/dl?inline

polygamous_bat 3y ago
> The complaint itself cites 'writing instructions on how to use a VPN' as evidence that the developers were knowingly doing something criminal. A VPN! As if the modus oparendi of sketchy crypto sites wasn't shouting off the rooftops "You can't use this site cause we detected a US IP we don't do business with US citizens. BTW, here's how to use a VPN!"

arp242 3y ago

They didn't "just" send a PR or "just" write some code, they made a financial tool which earned them millions while ignoring regulations for these type of financial tools. No one who sent a PR was arrested or even investigated: just the people running Tornado. This has been pointed out time and time again. Crypto wants to be taken serious as a financial tool. Okay, fine. This also means you have to follow the same rule as anyone else. Don't like these rules? Fine, you're allowed to – we have a democratic process for changing that so go vote, lobby, etc. Remember the 2008 banking crisis? There are reasons these regulations exist. Banks get fined for these types of things all the time too: https://duckduckgo.com/?t=ffab&q=bank+fined+money+laundering&ia=web https://duckduckgo.com/?t=ffab&q=bank+fined+money+laundering... – crypto isn't being singled out here. If you knowingly ignore the laws for personal profit you can expect consequences like this. Cryptopeople want to live in some sort of magical fantasy world where they both want to interact with real money and the financial markets when it suits them, but also pretend specific laws and rules for it don't apply to them when they're inconvenient. All while they're lining their pockets of course. Maybe this world has unicorns and dragons and teletubbies too.

miracle2k 3y ago
> They didn't "just" send a PR or "just" write some code, they made a financial tool which earned them millions while ignoring regulations for these type of financial tools. No one who sent a PR was arrested or even investigated: just the people running Tornado. This has been pointed out time and time again. Since TC is still running with both guys in jail, they clearly weren't "running it" - but the Ethereum node operators are. Should they be arrested? Are you answering this question as a laywer, or as citizen engaged in the democratic process telling me what you feel the law should be?
- arp242 3y ago
  They were developing it and making money from it, so that's "running it" by all but the most boring pedantic definition. Ethereum is a protocol and a tool, which Tornado used it to knowingly profit from illegal transactions. Ethereum is somewhat akin (not identical) to USD, and Tornado somewhat akin to a bank operating with USD outside of the law. I was unaware I need to get a university law degree before commenting here.

celtoid 3y ago

It's a far cry from what some members of the tech community did when the government was trying to restrict code and cryptography in the 1990s. People were tattooing perl scripts onto their bodies in order to protest the restrictions. God forbid people break the law to protest bad laws. "How to become an Arms Trafficker Become an Arms-Trafficker in one easy step with this great way to register your protest of ITAR by Vince Cate. Just click to submit the form and join in the protest. Lots of excellent links. Have you exported RSA today? Includes an option to email a protest letter to US president." [0] [0] http://www.cypherspace.org/adam/rsa/ http://www.cypherspace.org/adam/rsa/

JohnFen 3y ago
> It's a far cry from what some members of the tech community did when the government was trying to restrict code and cryptography in the 1990s. So? All that means is that there were people who thought that was a just fight and don't think that this is a just fight. > God forbid people break the law to protest bad laws. That's a legitimate form of protest and I won't condemn it. But when you break a law out of protest, you are still subject to arrest and prosecution for doing that. And often, that's the result you actively want because it brings attention to your cause and gives you a platform to argue the injustice in court. That said, it doesn't look to me like the accused here were engaging in civil disobedience. It looks like they were pursuing profit.