5 ms·

When the transactions come from marketplaces specialised in selling illegal substances you need implausibly suspended disbelief to think your obfuscation servic

When the transactions come from marketplaces specialised in selling illegal substances you need implausibly suspended disbelief to think your obfuscation service is only used for benign purposes. Then consider that most of the transactions processed by the fog came from places like silk road.

Ajedi32 3y ago
How would Bitcoin Fog know the transactions were coming from those marketplaces? Bitcoin addresses are just strings of random numbers. Maybe if they were performing a careful inspection of the source and destination of each transaction they could have discovered something that would have obligated them to act to block those addresses, but the whole point of a privacy service is that you don't do that kind of careful analysis of your customer's private data. The law doesn't require you to know affirmatively that the service is only used for benign purposes. Just about every public service in existence probably gets used to support illegal activity at some point or another. You just can't be knowingly assisting with a crime.
- nwienert 3y ago
  I wonder if the same people would argue like this if it was about VPNs - should they be liable and forced to keep logs? Or is this another example of HN's strong anti-crypto bias?
  - acdha 3y ago
    VPN providers aren’t financial institutions so they don’t have to worry about these laws. This will be very interesting legally as more states add things like age verification laws if those are worded to prevent VPNs from being used to circumvent them.
  - chx 3y ago
    Apparently, the ability to properly add and subtract numbers these days count as a bias. Every crypto"currency" utilizing a transaction fee is a negative sum game and those are scams. That's all there is.
- banannaise 3y ago
  We call this due diligence, and it's an essential banking practice. Willful ignorance is not a defense, particularly when large amounts of money are involved.
- swatcoder 3y ago
  If you were trying to run a signicant and profitable business, would you expect to know who your customers are? You need to be able to get your product in front of them right? Market to them somehow? And you must get outreach for support or partnerships now and then, even if you try to make yourself hard to identify or reach. They may have avoided collecting identifying information on specific individual people, but it's absurd to think that they could have reached the scale they did with no knowledge of where and for what purpose their service was being used. The startup engineer's fantasy is that you can build something useful and users will flock to it through no further involvement of your own, but that's almost never a thing -- and certainly not here.
  - Ajedi32 3y ago
    Is there any evidence Bitcoin Fog was marketing their service specifically to criminals? The affidavit[1] another user linked elsewhere in this thread says: > BITCOIN FOG was publicly advertised on Internet forums and well-known web pages promoting darknet markets as a tool for anonymizing bitcoin transactions. But it doesn't really go into detail. "well-known web pages promoting darknet markets" might just mean "Reddit". And I think you might be underestimating the impact of word-of-mouth advertising. I don't recall Tor or Mullvad having to extensively advertise to criminals in order to get as popular as they are now. [1]: https://storage.courtlistener.com/recap/gov.uscourts.dcd.230456/gov.uscourts.dcd.230456.1.1_1.pdf https://storage.courtlistener.com/recap/gov.uscourts.dcd.230...
    - codedokode 3y ago
      Tor and Mullvad are definitely tools for criminals, I am aware that they are often used to access illegal information which is legitimately censored by the government. And some news media outlets openly promote using these services to bypass the legitimate censorship.
- victorbjorklund 3y ago
  But you can use the same argument for if you take a bag of cash from a local drug dealer with instructions to obfuscate the source of the money and return them to him. How would you know it isnt legit money?
  - Ajedi32 3y ago
    There have been people unwittingly involved in money laundering schemes like that. https://www.consumerfinance.gov/ask-cfpb/what-is-a-money-mule-en-2108/ https://www.consumerfinance.gov/ask-cfpb/what-is-a-money-mul... Not a lawyer, but as far as I know its only criminal if you know or at least have a strong reason to believe you're participating in a money laundering scheme. That wouldn't apply to a privacy service that has legitimate uses, particularly an automated one where there's no opportunity to use common sense to reason about which customers are legit.
- olliej 3y ago
  The law has a variety of "know your customer" rules, but in addition has a bunch of laws the constrain your behavior if you can reasonably know that you are handling criminal proceeds. Anyone operating a crypto mixer knows that people will endeavor to use it to illegally launder funds, and to as I understand it if you know that, you have to implement _effective_ methods to prevent that illegal mixing. It does not matter that there are legal transfers, you have a legal duty to not carry the illegal ones, and if you are not actively trying to prevent those illegal transfers you are liable. A more day-to-day analogy would be that it is illegal to knowingly buy, sell, or accept stolen property. If you do buy stolen property but there's no reason for you to have thought it is stolen you haven't done anything wrong (though the purchase or sale is invalid, so you've lost the money). If however police can show that you knew or could reasonably know the property was stolen it they could chose to charge you with a crime, and your defense would presumably be some variation of why it was reasonable for you to believe the property was not stolen. The problem is specifically that everyone running a mixer knows that people attempt to launder their funds through mixers, and so therefore should have mechanisms in place to ensure that they are not accepting transfers that can reasonably related to criminal enterprises, just as you would have to when buying/selling property in the real world. Given that most crypto is trivially auditable there are very few arguments that would support not having at minimum automated rejection of transactions involving any known wallet, and moreover constantly updating the list of known bad addresses. Certainly if I were on a jury, and the person running the mixer could not show their reasonable actions to prevent laundering, that the system was constantly tracking, updating, and expanding the disallowed wallets precisely because that can be done almost entirely automatically, that would count against their claims to not be intentionally supporting laundering. Again, the issue here is not running the mixer, it's not that occasional illegal transactions go through - that's unavoidable - it's the failure to take reasonable steps to stop plausibly illegal transfers. The way banks handle this is they block suspicious transactions pending receipt of the actual sender and recipient, and documentation of the origins of the funds. Which is what a mixer would need to do.

Ajedi32 3y ago

How would Bitcoin Fog know the transactions were coming from those marketplaces? Bitcoin addresses are just strings of random numbers. Maybe if they were performing a careful inspection of the source and destination of each transaction they could have discovered something that would have obligated them to act to block those addresses, but the whole point of a privacy service is that you don't do that kind of careful analysis of your customer's private data. The law doesn't require you to know affirmatively that the service is only used for benign purposes. Just about every public service in existence probably gets used to support illegal activity at some point or another. You just can't be knowingly assisting with a crime.

nwienert 3y ago
I wonder if the same people would argue like this if it was about VPNs - should they be liable and forced to keep logs? Or is this another example of HN's strong anti-crypto bias?
- acdha 3y ago
  VPN providers aren’t financial institutions so they don’t have to worry about these laws. This will be very interesting legally as more states add things like age verification laws if those are worded to prevent VPNs from being used to circumvent them.
- chx 3y ago
  Apparently, the ability to properly add and subtract numbers these days count as a bias. Every crypto"currency" utilizing a transaction fee is a negative sum game and those are scams. That's all there is.
banannaise 3y ago
We call this due diligence, and it's an essential banking practice. Willful ignorance is not a defense, particularly when large amounts of money are involved.
swatcoder 3y ago
If you were trying to run a signicant and profitable business, would you expect to know who your customers are? You need to be able to get your product in front of them right? Market to them somehow? And you must get outreach for support or partnerships now and then, even if you try to make yourself hard to identify or reach. They may have avoided collecting identifying information on specific individual people, but it's absurd to think that they could have reached the scale they did with no knowledge of where and for what purpose their service was being used. The startup engineer's fantasy is that you can build something useful and users will flock to it through no further involvement of your own, but that's almost never a thing -- and certainly not here.
- Ajedi32 3y ago
  Is there any evidence Bitcoin Fog was marketing their service specifically to criminals? The affidavit[1] another user linked elsewhere in this thread says: > BITCOIN FOG was publicly advertised on Internet forums and well-known web pages promoting darknet markets as a tool for anonymizing bitcoin transactions. But it doesn't really go into detail. "well-known web pages promoting darknet markets" might just mean "Reddit". And I think you might be underestimating the impact of word-of-mouth advertising. I don't recall Tor or Mullvad having to extensively advertise to criminals in order to get as popular as they are now. [1]: https://storage.courtlistener.com/recap/gov.uscourts.dcd.230456/gov.uscourts.dcd.230456.1.1_1.pdf https://storage.courtlistener.com/recap/gov.uscourts.dcd.230...
  - codedokode 3y ago
    Tor and Mullvad are definitely tools for criminals, I am aware that they are often used to access illegal information which is legitimately censored by the government. And some news media outlets openly promote using these services to bypass the legitimate censorship.
victorbjorklund 3y ago
But you can use the same argument for if you take a bag of cash from a local drug dealer with instructions to obfuscate the source of the money and return them to him. How would you know it isnt legit money?
- Ajedi32 3y ago
  There have been people unwittingly involved in money laundering schemes like that. https://www.consumerfinance.gov/ask-cfpb/what-is-a-money-mule-en-2108/ https://www.consumerfinance.gov/ask-cfpb/what-is-a-money-mul... Not a lawyer, but as far as I know its only criminal if you know or at least have a strong reason to believe you're participating in a money laundering scheme. That wouldn't apply to a privacy service that has legitimate uses, particularly an automated one where there's no opportunity to use common sense to reason about which customers are legit.
olliej 3y ago
The law has a variety of "know your customer" rules, but in addition has a bunch of laws the constrain your behavior if you can reasonably know that you are handling criminal proceeds. Anyone operating a crypto mixer knows that people will endeavor to use it to illegally launder funds, and to as I understand it if you know that, you have to implement _effective_ methods to prevent that illegal mixing. It does not matter that there are legal transfers, you have a legal duty to not carry the illegal ones, and if you are not actively trying to prevent those illegal transfers you are liable. A more day-to-day analogy would be that it is illegal to knowingly buy, sell, or accept stolen property. If you do buy stolen property but there's no reason for you to have thought it is stolen you haven't done anything wrong (though the purchase or sale is invalid, so you've lost the money). If however police can show that you knew or could reasonably know the property was stolen it they could chose to charge you with a crime, and your defense would presumably be some variation of why it was reasonable for you to believe the property was not stolen. The problem is specifically that everyone running a mixer knows that people attempt to launder their funds through mixers, and so therefore should have mechanisms in place to ensure that they are not accepting transfers that can reasonably related to criminal enterprises, just as you would have to when buying/selling property in the real world. Given that most crypto is trivially auditable there are very few arguments that would support not having at minimum automated rejection of transactions involving any known wallet, and moreover constantly updating the list of known bad addresses. Certainly if I were on a jury, and the person running the mixer could not show their reasonable actions to prevent laundering, that the system was constantly tracking, updating, and expanding the disallowed wallets precisely because that can be done almost entirely automatically, that would count against their claims to not be intentionally supporting laundering. Again, the issue here is not running the mixer, it's not that occasional illegal transactions go through - that's unavoidable - it's the failure to take reasonable steps to stop plausibly illegal transfers. The way banks handle this is they block suspicious transactions pending receipt of the actual sender and recipient, and documentation of the origins of the funds. Which is what a mixer would need to do.