- Phil Zimmerman (PGP) was under criminal investigation for arms exports by releasing the code for consumer encryption. The case escalated and was eventually dropped, included POTUS attention.

- Aaron Swartz passed away via suicide in 2013 under threat of 35 years in prison and a lot else for downloading from JSTOR programmatically

- Clifford Stole spent several years being ignored by every govt agency under the Sun, except for CIA, for finding, attributing and then exposing a widespread KGB hack of govt systems in the 80s

- L0pht testified in front of congress to expose significant internet security risks that were otherwise ignored.

I’m not saying Tornado Cash and related devs were doing a purely moral action. But the automatic siding with the heavy hand of govt sanctions on code the govt doesn’t really understand is pretty shameful for a nuanced technical audience.

You can disagree with the sanction while still being understanding of GitHub trying to cut ties with the sanctioned entity. Or be critical of them being heavy handed in their compliance but agree with the sanction in general.

Plenty of organizations in the past have chosen what side of this conceptual line to stand on.

One can end up looking like the EFF with a long term, very strong reputation of standing up for clear boundaries of what’s right in the legal<>code context and go to court over it, or you can end up looking like GitHub.

When you're a donation based non-profit, it's easy to "stand up for clear boundaries". In fact, it's literally your purpose.

When you've got >$100Bn of profits on the line, it's a little harder - and you have a different purpose (i.e. to make money).

Perhaps there is some grey area as to what qualifies as a service being provided to that entity. Is my fork still a service being provided to them? Or is it a service being provided to me? But that is still something useful to the sanctioned entity, so am I now providing them a service? In which case GitHub is still a party to providing them a service.

There's a massive difference between "nope, I won't comply with the law" and "I think this law is a bad idea, let's go to the courts to see if we can do something about it". And GitHub has done the last, too, to restore access to Iranian developers for example.

I don't agree with a lot of things in the world, but the only thing I wish for them is for things to get better, not worse.

The funny part is he's contributing to the problem, as in not realizing it's the working class vs the rich, not the left vs the right.

Also, Ethereum has been "soon to be env-friendly PoS" for years now. Let's revisit that if and when it actually happens.

In a country where a dictator can make you starve with a snap of the fingers, cryptocurrencies are vital to survival. So even 10x more energy 'wasted' on such an indespensable service would still be a bargain I'd take.

In a country where a dictator can make you starve with the snap of the finger, what are you going to do, eat your virtual coins from your jail cell? Technology is notably not a solution to social problems

If there will ever be an uprising, it'll be funded with nothing else but cryptocurrency.

So yes, cryptocurrencies are worth every watt of energy they use.

Yes, you’re correct, the judgement is about what the energy is used for.

Bitcoin alone is estimated to use 150 terawatt-hours of electricity annually.

The US Department of Energy estimates that there are 80 million households with dishwashers in the US (although they believe 16m never use them, but we will ignore that). It appears that the average dishwasher uses 251kWh annually (at the avg of 215 cycles per year).

So this would put the US annual dishwasher power consumption to around 20 terawatt-hours. This would mean that the rest of the world would need approximately 518 million household dishwashers used 215 times a year each, to make up the rest of the power usage for just Bitcoin.

When you start factoring in the size difference in dishwashers between countries, the power usage differences between 120v and 220v in different parts of the world, the overall adoption rate of dishwashers etc... it makes it hard to believe that they could compete with crypto power usage.

Bitcoin just consumes extra energy, not makes an existing process more efficient.

The switch has been delayed 6(!) times since 2017. It‘s perpetually happening “soon”. I believe it when it’s actually live.

I'm grateful to live in a society where this is not a "problem", but I don't take it for granted

Seems like every celebrity and talk show host was pushing NFT's, be it Kardasians, Kimmel, Fallon, even Bill Murray released a collection 1 month ago. Ultra stars like Tom Brady to Mark Cuban were investing and (still) talking about crypto companies they are heavily invested in. Half the superbowl ads this year were advocating for people to waste money on crypto.

What is the name of this sanctioned entity that GitHub supposedly cut ties with?

You'll note that none of the developers who had their accounts suspended were themselves sanctioned.

As far as I know, Tornado Cash is not a legal entity either.

It seems like it's always been a tiny minority of idealists who put their own lives on the line to do what they believe is right in the face of the beast bearing down on them.

The majority has always been (and probably will always be) weak minded corporate yes men.

What is distasteful is the so called "hacker" community being filled with corporate yes men.

Also: GitHub is a private company. It's their real estate, they can do what they want with it. If they wanted to keep it up, they could have.

They didn't want to.

A legitimate example of free speech. Zimmerman published his code in the appendix of scholarly book, in addition to posting online in source & binary form.

> - Aaron Swartz passed away via suicide in 2013 under threat of 35 years in prison and a lot else for downloading from JSTOR programmatically

A terrible example, and not comparable to your first example. Swartz gained physical access to a network room he was not supposed to be, inside a building he was not supposed to be, connected a laptop to a LAN he was not granted access.... When you say programmatically, you must mean the parts where he proceeded to download JSTOR using his laptop? Has was criminally trespassing, accessing a network he knew he wasn't allowed to access. The tragic outcome was due to... hate to say it, he had well known mental issues that amplified the stress he felt when being indicted for a crime he knew he was guilty.

So I get what you're saying, but you might want to limit your examples to abjectly reasonable ones that withstand scrutiny. Otherwise it might look like a bandwagon, generalization, or even false dichotomy.

I remember those events clearly and even JSTOR, the "victim" in the case, backpedaled on the prosecution before he committed suicide. He was driven to suicide by an overzealous federal prosecutor trying to make a career for themselves.

[1] https://www.cnet.com/tech/tech-industry/swartz-didnt-face-pr...

Or, if you blame the prosecutor for driving him, do you also blame his friends and family for not being supportive enough?

Moreover, judges don’t care about prosecutors or what they think. And, sentences are largely determined by sentencing guidelines.

Rich white kids with no prior convictions don’t go to prison for stealing library books.

This doesn't mean that any/all measures taken against them are automatically justified, but it's large-scale crime, and it's not in the realm of "information wants to be free", it's actual money laundering, for actual criminal cartels and actual rogue states.

The automatic opposing of govt sanctions is pretty shameful for a nuanced technical audience.

But they do understand it, quite well. It launders money, there is no legal use for a money laundering machine.

No, this still isn’t a valid use.

Cash cannot be so easily laundered as literally sending coins to an address and waiting a few minutes. Laundering cash requires physical infrastructure which can be tracked and monitored.

People like you are why crypto is dying. Not everybody needs to anonymously buy drugs online. When non-crypto bros here things like this they mark you and your project as criminal.

Here's an analogy: Is it hypocritical to say "we shouldn't punish people who sell marijuana," but also say "we should punish people who sell heroin?"

Maybe you disagree with the person's preference for what should be punished, but saying "we should punish this behavior but not that behavior" doesn't make a person a hypocrite.

Would you stop the above chain of events at the very first link? Would you say: "We can't ban trojans because it's code, and code is speech, and speech is either free or its not?"

Is not a comment on free speech or not. There are rumors of government sanctions for this specific case, but the typical deplatforming is more like getting kicked out by the bouncer.

GitHub had to do this. It was required of them by law. Tornado was sanctioned.

> These prohibitions include the making of any contribution or provision of funds, goods, or services by, to, or for the benefit of any blocked person and the receipt of any contribution or provision of funds, goods, or services from any such person.

This is, unambiguously, directed toward entities such as GitHub providing them service.

I'm not a fan of GH these days but they did the only thing they could do in this situation. You can be upset about it, but you can't be upset at GitHub about it.

For what it’s worth, I don’t see much evidence of people being upset at GitHub in the thread. There’s talk about decentralized alternatives, but not much actual pinning the blame on them.

Imagine if, say, A foreign electronics company is sanctioned by the government - does this mean that anyone who has previously worked with them or bought their electronics has done so illegally? If so, that sounds like a significant impediment to commerce, since nobody can predict who will be sanctioned in the future.

This consideration would apply if and only if the government would actually pursue criminal charges against someone who contributed to TornadoCash - which they possibly would if someone would do stuff after these sanctions e.g. try to circumvent this GitHub block, make and advertise a replacement service, etc; do not do this if US laws apply to you.

I understand this to be the case. I don’t understand how anyone considers this to be even remotely sane.

We landed with the concept of a "common carrier."

Railways, as well as telecommunications companies, ISPs, public airlines, bus lines, taxicab companies, phone companies, cruise ships, motor carriers, freight companies, and others CANNOT discriminate.

As an individual or a small business, ones does not have an alternative to Microsoft Word, github, or Facebook.

If these companies are allowed to discriminate, we'd be in a position where, again, monied entities can shut down individual small businesses, or ostracize individuals, as they see fit.

Once you provide a sufficiently central service, you should not be allowed to discriminate.

Google Docs, gitlab or bitbucket, and as for social network there's plenty out there.

None of those are real monopolies. They _might_ be best in class, but there's no rule that says you must be allowed to use the best in class service.

I believe the information was visible to either all logged-in users or just all visitors, but that still requires facebook to serve the page to me.

   Common Carrier <= Monopoly

1) If I want to exchange redlined documents with lawyers, I need Microsoft Word. I cannot run a successful business which deals with law firms without Microsoft Word. Most businesses need to deal with law firms. If Microsoft shuts me out of Word, I cannot have a business.

2) If I want to promote my local business, I need to be on social media platforms which my likely customers use.

3) The same goes for niches. If I'm supporting K-12 writing teachers, I need to support Google Docs.

It's not a question of alternatives, best-in-class, or anything else. It's pure network effects. If a platform is >50% dominant in my market, I need to support it, or I'm out-of-business. No one will switch from Twitter to Mastodon or Parler for the sake of doing business with one small business. They'll go next door.

Once a firm has that level of market power, I think it ought to be regulated, both for the same reasons and in the same ways as railways were in the days of Standard Oil.

These companies can literally just kill a small business if they chose to. That's not healthy.

I find your reasoning here disingenuous. I have been running a business for almost 2 decades, dealing with law firms and everything and I haven't used Word since I was in high school.

Microsoft Word makes the world go round. Sure I can use Wordpad and export a docx file, but no tables, no special effects, etc

Funnily enough, several of the things you have listed (I believe, actually, most of them) are not common carriers but contract carriers. That means they can discriminate, except against the enumerated prohibited classes.

- Microsoft Word — Google Docs? Apple Pages? Zoho Docs? OpenOffice?

- GitHub — GitLab? sourcehut? Bitbucket? Gitea?

- Facebook — Twitter? Instagram? TikTok? SnapChat?

The thing about Git is that it's free software. Anyone can run their own server for very little money. If you get banned from the railroad, you can't just get your own train.

The value comes from the network.

This: "GitHub shouldn't be allowed to deny me service because I want to use it" isn't a fair paraphrasing of my argument. I don't think it's likely that github would ban me specifically.

My argument is Microsoft (and Google, Facebook, etc.) shouldn't be allowed to cancel/bankrupt/ostracize competitors, critics, political opponents, or others they don't like. That means we should all be able to access those platforms under equal RAND terms.

If Microsoft is allowed to play dirty, the major impact on me is indirect, in that we will have fewer checks-and-balances in society (people and organizations will be afraid to criticise them), less competition, less innovation, more political corruption, etc.

Antitrust hasn't kept up with technology. In this case, though, we developed perfectly good mechanisms (and learned what happens without them) a century ago.

  > Antitrust hasn't kept up with technology.

(a.k.a robert bork and the "its not consumer harm if prices keep going down" school of thought with regard to anti-trust)

With Standard Oil, prices didn't go down, except in the very short term. Monopoly can seek out higher profits once monopoly is obtained.

The pricing of LinkedIn, of dating web sites (almost all now owned by match.com), and of many other services is astronomically high, mostly because they can.

  > many other services is astronomically high, mostly because they can

Also, use a private account for private stuff, if that wasn't obvious

- git by design completely decentralized.

- crypto by design and inherent in its philosophy decentralized

"GOVERNMENT SHOULD MAKE GITHUB GIVE ME AN ACCOUNT!"

Why do you say that?

And that's where all the developers who contribute to my projects have accounts.

There's nothing magical about the github system, but it's where the network of projects and developers lives.

I don't think anyone can say Nike has 20% of all US customers of shoes.

But its almost certain that Github has > 20% of all US customers in software development.

Here lies the point. In order to enforce antitrust, there should be a clear line that once crossed, you are deemed a common carrier or something to that effect.

I think even as low as 10% of the US market for a given good or service sounds like a reasonable threshold where you automatically lose rights as a US company to determine who you associate with arbitrarily (because your lobbying power and market power are so great at 10% of market, you need to be neutered in some fashion once you reach that size)

https://csimarket.com/stocks/competitionSEG2.php?code=NKE

I truly don't understand the logic of stating every organization with 10% market share of any kind of product is now instantly a "common carrier". To me that's massively watering down the meaning of "common carrier" past the point of usefulness. A common carrier classicially is when there's realistically no possible alternative. There's really only going to be one or two railways going through a city or town. It doesn't make sense for there to be a dozen different water systems or coax telecommunications providers or fiber providers or electrical providers in a city. But if Nike doesn't want to sell me shoes I can just go to Sketchers. Or Addidas. Or Vans. Or Footlocker. Or Journeys. Or Kohls. Or any other of a dozen different department stores. Or Target/Walmart/other big box store. If Nike doesn't want to sell me shoes, there's tons of other options. Even just buying Nikes at a different retailer! And that's just in person shopping, never mind the literally thousands of retailers online willing to ship me shoes!

But no. Nike is now a common carrier. They must do everything they can to ensure I can buy their shoes at a government-ensured fair price. So they must build a store in the middle of nowhere to ensure I can easily walk there, look at their wares, and decide I'd rather just buy from TOMS.

Then the idea that GitHub is a common carrier is even more distant. There's lots of options out there. You could use GitLab, Bitbucket, Team Foundation Server, JetBrains Space, Beanstalk, AWS CodeCommit, Google Cloud Source, Sourcehut, and so many others. They're all right there on the internet. You don't have to sell your house and move to the next county over to use Bitbucket. You just change your remote and push.

On the other hand, they are a common carrier - they aren't limiting which countries or streets I'm allowed to wear their shoes on, nor what kinds of sports I choose to play with them.

I don't think anyone would be favourable to giving Nike more control over how people use their products

That's...not a common carrier at all. Traditionally, a common carrier is "a person or company that transports goods or passengers on regular routes at set rates." So traditionally, a rail line is a common carrier. A pipeline is a common carrier. Air freight and truck shipping, kind of, but you're then getting away from that "regular routes" kind of thing. This was then logically expanded to things like telecommunications, since they're essentially transmitting data along regular routes aka the actual telephone wires.

A big thing about becoming "common carriers" was this idea of regular routes. Competition gets challenging/impossible when there's really a single route for some things. There's really only going to be one set of rails connecting towns. There's not going to be a bunch of different companies stringing telephone wires to everyone's houses. There aren't going to be a lot of fiber runs through a neighborhood. These things are all common carriers and are natural monopolies.

I can go buy an apple at the grocery. I can eat that apple raw. I can turn it in to apple sauce. I can bake it in a pie. I can juggle with it. I can give it to a friend. I can donate it to charity. The fact I can do all these things with it does not make the apple producer or the grocer a common carrier. It's entirely unrelated.

The person I was replying to was stating any company with 10% market share in any kind of metric should be considered a common carrier. Nike has more than a 10% market share in total revenue of sport clothing. So they say Nike should be a common carrier. This makes no sense to me.

Notice im talking about shoes, not sneakers. theres a ton of womens wear that probably is a significant share of the whole market, of which nike has exactly 0%

Lets make it simple so there is no misunderstanding. Any company ownning at least x % of a given NAICS or SIC code. There.

Also, expanding out to "all shoes" or all apparel is like making GitHub "all developer-focused Software-as-a-Service". Can I really use Prada Satin platform sandals with crystals in the same way as Nike React Infinity Run Flyknit 3's? No, their utility is very different and they're not really interchangeable. Can I use Sendgrid in the same capacity as I use GitHub? No, their utility is very different and they're not really interchangeable. You need a tighter market segment to point to, such as at least "sports clothing" or "fashion clothing" or "source-code management" or "external communications tools".

Even then, I'm not so sure GitHub definitely has 20% or more of that whole market. It definitely has deep penetration in some parts of the market and it wouldn't surprise me if it does have 20% or more, but I wouldn't just necessarily just assume that. Do you have any information to share on actual marketshare? I don't and I did briefly look for it.

Unless some content is more “freedomtastic” than others but then that leads to determining what is acceptable speech and what is not. That is more dangerous than allowing private entities complete control because the central tenet of freedom of expression is that all expression is equally free.

In actuality no speech is more or less valid— you just have no obligation to propagate it no matter how important or unimportant it is.

And the scale argument, what most people fall back to when they realize that their initial position is indefensible, is irrelevant.

A single word written on a scrap piece of paper read by one person is just as important as a mass-messaging appeal that is vital to the billions.

An organization, vital to the very existence of all human beings on earth has the same rights to control their property as a single homeless person whose only possessions are the things he carries on his person.

Or at least, they should. Perfection is unattainable but we should strive for it so that systems where a homeless person doesn’t have the same protections as a multibillion-dollar corporation should not see calls for the large entity to have its rights curtailed but instead should see calls for the small entity to have its rights enhanced.

As far as I’m aware the only exceptions to this, broadly speaking, have been those made for health and safety purposes or when entities have been granted a license or permission to own finite public resources like the radio spectrum, or if criminal law has been violated.

I agree that GitHub’s actions are not regulated by the constitution or criminal.

Additionally I imagine Guthub’s contract terms are such that they can cancel at any time for any reason.

What I intended to say is “I agree the poster who complains of retroactive account deletion. We can look to the constitutional process for some reasons why retroactive punishment might be a bad idea.”

I did not mean to imply that GitHub’s actions were unconstitutional. They were bad actions for the same reasons that the constitution bars retroactive punishment. It’s hard to guide current behavior based on future law. They were likely legal.

I meant to offer the constitutional reasoning as a source for why retroactive punishment is problematic. Not as the binding legal principle.

I agree GitHub CAN do this.

My post offered the opinion GitHub should NOT do this.

I think your analysis is flawed. They didn't come up with some new law and apply it to these people ex post facto. These accounts were contributing to the money laundering (per accusations, albeit indirectly).

Another way to look at it: if these people were contributing knowingly to a project that was laundering money, should they be punished? Of course.

If they are being punished for money laundering committed in the past while money laundering was illegal, that’s good enforcement.

If they are being punished for previous lawful contribution to an entity that was in the future sanctioned, that’s bad enforcement.

Everyone who has ever contributed to an open source project _could_ be (in the absence of the project setting up proper legal structures) considered a membership of a general partnership, and thereby become jointly and severally subject to unlimited liability for the actions of the partnership.

(IANAL this is just what I've read online)

Outside of a project that takes contributions / donations without a legal entity to receive them and parcels those out amongst the contributors, I can't think of a reasonable situation that would enable such a definition.

I managed to dig up the mailing list thread where I read about this risk: https://groups.google.com/g/linux.debian.vote/c/Nl-J8h2pO9A/... for context, Sam Hartman is a former Debian Project Leader and I assume his opinion is formed by advice from SPI's lawyers.

That's not what's happening here. What you're seeing is a US company evaluating its ongoing business relationships, and making the decision that continuing to associate with principals of a designated company isn't worth any potential legal risk.

My understanding of the American justice system says you cannot do this, our founding fathers did not want any witch hunts, laws should deter future abuse, otherwise people might as well never do anything, ever.

Anyone contributing to Tornado after it became public knowledge that it was used to launder money put themselves at risk. The sanctions are the enforcement action. A wanted poster. The crime, laundering money, was committed a while ago.

> does this mean that anyone who has previously worked with them or bought their electronics has done so illegally?

If you knew they were doing sanctionable things, yes. If you didn’t, no.

Tornado is a super basic privacy layer that has been used as such for many years for countless legitimate purposes. Transaction privacy is obviously something that is in high demand by the general public, and they have it. Of course criminals might use it too, but doesn't the general public deserve the ability to make transactions without the world watching? The idea of making privacy tech illegal is absolutely outrageous, and it blows my mind that any reasonable person would take any other stance.

Should we ask the government to publish a registry of approved technologies to ensure own safety?

I don’t have the technical answer. But from the instant tumblers became a thing everyone with AML experience saw the endgame. It’s providing, as a service, a function directly analogous to real-world layering. It does nothing else. And nobody involved seems to have taken the prospect of criminals using their product seriously.

Messengers are not money, so laundering goes out the window. PayPal is regulated. And crypto does other things. Tornado just served to hide the origin of money. And it was used to launder illegally-gotten gains.

A traditional banking analog would be if the feds went after brick and mortar banks for allowing customers to deposit checks from named payors and withdraw cash or create a new check. A law-abiding customer might take advantage of this property to receive a paycheck from an abortion clinic and then make a donation to their church. Whereas a criminal might use the same scrubbing to receive a payment from a known drug dealer and then turn around and pay their mortgage. Yet the bank's whole business isn't declared a priori illegal due to concealing the origin of the funds on the outgoing payment.

The archetypal laundromat also does normal folks’ laundry. It just also launders money for criminals. I’m sure they would happily layer money for non-criminals but nobody does that.

> banking analog would be if the feds went after brick and mortar banks for allowing customers to deposit checks and withdraw cash

If they did that without checking anyone’s identity and then, after learning—from law enforcement no less—that criminals were using them to launder money, kept going, business as usual, hell yes they’d be shut down and arrested.

This thread is full of these blind assertions that nobody except criminals wants financial privacy. They are patently false.

> If they did that without checking anyone’s identity and then, after learning—from law enforcement no less—that criminals were using them to launder money, kept going, business as usual, hell yes they’d be shut down and arrested.

You're basically saying that once a service gets used by a criminal, then operating that service becomes illegal because it is furthering criminal acts. This seems like yet another Godelesque everything-is-criminalized result, and your appeal that one can avoid persecution by electing to perform blanket investigation on all one's customers isn't particularly redeeming.

Like sure I get the traditional banking industry has been practically inundated with these type of invasive heavyhanded regulations to make things easier for law enforcement, but that's not a particularly compelling argument.

If the operators know that people are using their service to launder money, and they keep operating their service without doing anything to prevent that, then… yes? What do you think should happen? They just get to keep doing crime?

You're writing as though this were uncharted legal territory, trying to reason from first principles when you can truly consider a business a criminal enterprise, but we've had laws on the books for decades for the express purpose of stopping people from doing exactly what Tornado Cash does.

Now it is moot after sanctions are in effect. What we are discussing is mental world model of software engineers before Tornado sanctions were announced and their accounts wiped. It might be hard to see in hindsight.

I think this is probably an AUP question. The sanctions are a big enough "hey these users broke the law" signal.

We are talking about an entity that according to the treasury has laundered more than 7 Billion USD, assisted criminals and neglected complying to Anti-Money Laundering/Countering the Financing of Terrorism (AML/CFT) obligations willingly and repeatedly. Tornado Cash has repeatedly failed to impose effective controls designed to stop it from laundering funds for malicious cyber actors, regularly and without basic measures to address its risks.

This according to the treasury goes on for years since its creation, so everyone who actively contributed to the entity is considered a threat to national security and often, if you look at the sanctions list of OFAC sanctioned entities, rightfully so.

Retroactively, and to my knowledge, there is not a single investigation and OFAC sanction that got lifted by a court because the accusations themselves were wrong. And it's not like you don't have the right to appeal those sanctions. Entities and sanctioned people quite often do so, and fail.

See https://www.cadc.uscourts.gov/internet/judgments.nsf/C2B2FFF... for example.

Tornado Cash is not just a foreign electronics company that stumbled into an OFAC sanction because it accidentally sold a Toaster to Kim Jong-un, so he can enjoy a crispy morning toast.

Where you are right is, that OFAC sanctions are a significant impediment to commerce because you cannot predict who will be sanctioned in the future. That's why, as a company or even individual, you need to do due diligence on who you get in business with.

If you import fruits and someone gives you 5k per box of Avocados extra to import them from Mexico to the US asap, you can bet there are not just Avocados in those boxes. You can pretend you didn't know, but if you don't want to end up in jail for providing service to a cartel, you need to make sure there are only Avocados in those boxes and the premium is for extra fast shipping.

Everyone knows that virtual currency mixers are commonly used by illicit actors to launder funds, especially those stolen during significant heists. This is at least common knowledge since the Silk Road days.

So if you contribute to such a project, that has the potential to harm your fellow citizens and contribute to financing of terrorism, without making sure it is complying to Anti-Money Laundering/Countering the Financing of Terrorism (AML/CFT) obligations one hundred percent, you can't just cry foul play and say I didn't know anything of this. Especially if you understand code and the inner workings of said project or have a direct line to the people in charge if you frequently contribute.

So, in my opinion it's more than ok if everyone who contributed to Tornado Cash and enabling it to do what it is accused of, their life should turn to sh*t immediately and everything they touch from here on. Because getting people harmed or financing terrorism or foreign state actors is not a trivial offense. Laundering virtual currency for criminals hurts real people.

When you're working on other privacy/security technologies, they have substantial enough other uses that you are plausibly able to argue that you were ignorant of its use in illegal steps.

There's a plausible argument that none of the sanctioned individuals were or are involved in running any kind of financial service.

This is closer to sanctioning developers of cryptographic libraries than it is to operators of a coin mixer.

This equivocation is as saddening as it is predictable.

It's only illegal under 18 U.S. Code § 1956 to conduct transactions to obscure the source of "the proceeds of some form of unlawful activity." There's no law against obscuring the sources of cash flows in general. And on an otherwise completely public blockchain, there was a major use case for obfuscating flows for the sake of user privacy.

https://web.archive.org/web/20220808155413/https://twitter.c...

> We are talking about an entity that according to the treasury has laundered more than 7 Billion USD, assisted criminals and neglected complying to...(AML/CFT) obligations willingly and repeatedly.

The Tornado Cash mixer contracts have been immutable since May 2020. It's a dumb piece of software that can't be modified or upgraded. Its authors have no control over who uses it on the blockchain.

https://tornado-cash.medium.com/tornado-cash-is-finally-trus...

It's kind of a strange accusation to say that someone has 'willingly and repeatedly' neglected to comply with legal obligations by failing to do something that's technically impossible to accomplish. All the GitHub users did was write code, and simply writing code, while not executing it to do something illegal, seems like it would be pretty well protected by the First Amendment, since code is speech. Turning people's lives to shit over what a software tool they invented gets used for later, after it's completely out of their hands, is pretty wild.

You copied and pasted Brian E. Nelson's complaint:

> Secretary of the Treasury for Terrorism and Financial Intelligence Brian E. Nelson. “Despite public assurances otherwise, Tornado Cash has repeatedly failed to impose effective controls designed to stop it from laundering funds for malicious cyber actors on a regular basis and without basic measures to address its risks.

But what Nelson fails to mention is that a) everyone involved has failed to impose 'effective' controls because it's physically impossible for anyone to, and b) basic measures to block sanctioned entities were actually implemented by the operators of the Tornado Cash website (which just got added to the SDN list anyway). So the complaint is that the control measure in place isn't an 'effective' control measure against entities that don't use the website.

https://www.coindesk.com/tech/2022/04/15/tornado-cash-adds-c...

And not that the exact number matters, but the Treasury is alleging an obviously maximally exaggerated amount of money laundering. $7 billion is the total value of deposits into Tornado Cash over all time. For that to be $7 billion laundered, 100% of all deposits, ever, put into the mixer would have to have come from illegal sources, which is obviously false. Depositing legally earned money into a privacy smart contract isn't money laundering. A sizeable portion of deposits are illicit, but far from a majority.

>Since becoming active in August 2019, Tornado Cash has received over $7.6 billion worth of Ethereum, a sizable portion of which have come from illicit or high-risk sources.

https://blog.chainalysis.com/reports/tornado-cash-ofac-desig...

You make an excellent point. The entire point of Tornado Cash is[0]:

"Tornado Cash is a cryptocurrency platform. It is a Cryptocurrency tumbler, a service that mixes potentially identifiable or "tainted" cryptocurrency funds with others, so as to obscure the trail back to the fund's original source."

From a legal standpoint, such functionality has few (if any) purposes other than to circumvent the law.

As such, preventing such activities is likely a societal good.

I expect you won't get a lot of love from some folks here, as they aren't interested in societal good. They seek license to do what they want whenever they want, without regard to the impact on the society in which they live or those they live alongside.

And in most cases, that's just fine. I strongly value liberty myself. I'm not as dogmatic as some, but I strongly believe that the only actions which should be proscribed are those that limit the liberty of others.

In order to maintain that liberty, it must needs be an ordered liberty that discourages activities that cause harm to others.

All that said, what governments decide is "criminal activity" is often arbitrary and unfairly/unevenly applied.

This creates distrust in the legal system, which Tornado Cash circumvents. Which is why not a few law-abiding folks (especially in the age of surveillance capitalism[1] want the capabilities (anonymization of financial transactions) offered by Tornado Cash.

What's more, the legal system in the US actually works pretty well, as compared with other nations around the world.

It's not the best, nor is it free of flaws, but it's definitely better than nothing.

This (how to make our ordered liberty as broad and as fair as possible) is a complicated and nuanced topic. I haven't done it justice in this comment.

While I do appreciate the value of a platform like Tornado Cash (how, and with who, I effect financial transactions shouldn't be of concern to anyone other than those involved in a particular transaction), it's pretty clear that without appropriate controls (AML/CFT regulations) enormous harm can be done. In fact, this episode shows that enormous harm was done in the absence of the implementation of those regulations.

Github will comply with the law when it is required of them.

They have a business to run.

[0] https://en.wikipedia.org/wiki/Tornado_Cash

[1] https://en.wikipedia.org/wiki/Surveillance_capitalism

The currency that finances terrorists the most is the US Dollar.

if you believe the biggest terrorist is the US Govt and State Department than it's your morale due to use crypto.

The IRS and bodies responsible for enforcing laws like those against "funding terror" (remember that?) certainly think that is crazy.

I'd say that this is a significant risk that people doing DeFi need to have a long, hard think about. Without a clear organization, without clear leadership, one cannot draw a bright line around those who deserve sanctioning. In court, efforts made towards plausible deniability might pay off. But github is not the courts, its interest is its own liability.

It looks like it was just the three creators. If they’re smart, this is a prelude to announcing a legal defence fund.

The other parts, like issue tracking, obviously are not.

This could have been mitigated by having a pre-determined fallback origin (which could very well be something they had in place - I'm not familiar with this project).

On the contrary, removing the common, centralized origin makes the project decentralized by definition.

You're right, of course. My previous post was written up a bit too hasty :)

They only had to block accounts that contributed after establishing the sanction. It's not clear that they limited themselves to those. It would in fact seem to be hard to contribute in the limited time range between establishing the sanction and removing the project.

There is also the collateral damage of removing unrelated projects that happened to be owned by these people. Couldn't github preserve such projects while putting them in some ownerless state?

The people who built Tornado Cash are already in trouble. The crime--facilitating money laundering--has already been committed. OFAC is an enforcement office. Its lists are more like wanted posters than rules.

GitHub is cutting ties with people likely to be charged with federal crimes. If some of them are going to continue contributing to the project, GitHub doesn't want to be the conduit through which it is done. This is all standard sanctions compliance.

Did the people who built blockchains with built-in mandatory mixing (Monero) or optional completely obscured transaction inputs (ZCash) also facilitate money laundering? If not, what is the crucial difference? Am I myself in trouble for having (co-)designed a mixing service [1]?

[1] https://forum.grin.mw/t/mimblewimble-coinswap-proposal

Probably not? Tornado Cash provided one service: mixing. (In AML parlance, layering.) We know it was used to launder the proceeds of crimes. The developers knew that too, and they kept working on it. Semenov styled himself as a co-founder and the group advertised open positions on its website. All that looks much more like an enterprise knowingly facilitating laundering than a developer publishing interesting code.

ZCash and Monero look like cash. Tornado (and every mixer I’ve seen) looks like a layering service. Those aren’t illegal per se. But you’re at risk if a criminal uses it. (You’re in deeper shit if it becomes known a criminal used it and you do nothing about it.)

So I guess what made Tornado Cash criminal, is that there was evidence of such...

Yes

>Am I myself in trouble for having (co-)designed a mixing service [1]?

Possibly? Depends on the details.

Then american banks should be sanctioned, they are also involved in money laundering too.

Why aren’t these banks put on the sanction list where it’s a crime to do business with them? Because the vast majority of what they do is not money laundering and when they are discovered money laundering, they generally stop. And when they don’t, they are added to this list: https://www.treasury.gov/ofac/downloads/sdnlist.txt

Whereas Tornado Cash is a service that is known to enable huge amounts of money laundering, and nothing was done to stop it.

What could be done to stop it? It's just a contract run on the blockchain. I suppose they could limit throughput, but not much else?! Similarly, what could the Monero or ZCash developers do to stop money laundering on their blockchains? Here, not even throughput can be limited since amounts of transactions are completely hidden.

Does this exist?

But crypto-bros will be crypto-bros, wether they are the minnows hoping against hope that they can somehow move from greater fools to slightly less foolish or the sharks grifting all the minnows for every penny they have.. just kept living in denial or .. selling denial in the case of the sharks.. and now here we are.

It turns out that when you ask the global financial systems what they call a service that does what a mixer does, they reply 'a money laundering operation operating in plain sight'.

More interesting and recent is zkKYC (2021): https://eprint.iacr.org/2021/907

Dunno. If you learn your product is being used to commit crimes and can’t figure out how to counter it, you should stop building it. (Or at least pause and call a lawyer.)

This is a far different standard. If we're talking about banning people because they seem like they might get charged with something, that's just a blacklist.

> If some of them are going to continue contributing to the project, GitHub doesn't want to be the conduit through which it is done.

That's why you delete the repositories. These are not sanctioned persons, this is a sanctioned project.

Edit: Unless it was members of the organization who had direct write access to the repos? Which I saw mentions of in other comments.

You'd think after 16 years I'd be used to it, but it still kinda blows my mind that the social network designed for context- and detail-free hot takes is the one people use for political discussion.

Having to explain yourself long form leads to people attacking you and often being correct.

Typically, people just take a paragraph or so of a long form political argument out of context and use it to call the person making the argument evil. Which is basically the same principle as the typical political attack ad where you take a sentence your opponent said out of context to make your opponent look like a crazy extremist.

With a short form discussion platform, you can just go straight to the personal attacks, name-calling and out of context distortions of the other side's beliefs. Then we wonder why we suddenly live in a country where the 2 political parties can't compromise on anything and where one of the top political priorities for both parties is prosecuting and jailing their political opponents. I think its very dangerous to view most political discussion being short form context free hot takes as either inevitable or healthy for a government based on free and fair elections (such a norm, however, is probably beneficial to the long term stability and security of a dictatorship). In a society with a democratically elected government, you need free, civil and respectful discussion of issues and a basic level of respect for those who disagree with you. Remove those things and democracy dies just like a plant dies if you deprive it of water and dirt.

Read the books “mindfucked” and “targeted” for the detail on Cambridge Analytica (actually Strategic Communications Laboratory or SCL group) how it was a cognitive warfare firm developed for counter terrorism which was unleashed on the American, British (and now presumably Brazilian, Italian and French public).

People are not polarized just due to social media - social media is now a cognitive warfare battleground where cognitive heuristics are the trenches.

Sanctioned project's contributors must be deleted from the server - where is that written in the list of things Microsoft has to do since you went out of your way calling everyone on the reply train ignorant?

This is quite simply not how a sanctions regime works. The US government does not make a list of all the sanctioned persons’ assets, then start going after those in court.

Instead, it goes the other way: any company with a US nexus watches those sanction lists carefully. When someone is listed they look at their internal records for hits and denies them service. So no one told Microsoft anything; they self-enforced a sanction that applies to everyone in the US. And I mean everyone: if an individual knowingly violates these sanctions they’re breaking federal law - it’s not just companies.

So when you contribute code to an open source project, you generally do so under an open source license. All of them generally contain something akin to the following:

    IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE
    LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
    SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES

I can understand taking action against the people who run the code. I can even understand taking action against people who were hired to contribute. But why kick some random open source contributor in the guts? What did they do wrong?

Are there open source licenses that protect the contributors from such unforeseeable damage? Or are we to watch our step from now on as open source contributors?

The argument probably is that they assisted a sanctioned entity by providing a contribution i.e. service to it. Quoting US Treasury "These prohibitions include the making of any contribution or provision of funds, goods, or services by, to, or for the benefit of any blocked person and the receipt of any contribution or provision of funds, goods, or services from any such person."

However, the major factual question is whether they did violate any sanctions since the contributions generally were made before the sanctions were in effect - it's not that Github had to do it, but that they chose to be safe rather than sorry (in order to ensure that Github themselves don't violate the sanctions) and if they aren't absolutely sure they blocked people. [edit: apparently not everyone, some contributors are not blocked, so they apparently did some review before choosing whom to block]

The key issue is that any collateral damage is considered acceptable, but any false negatives are absolutely not. If Github leaves even one actual agent of TornadoCash unblocked, Github has committed a crime, if they block a hundred unrelated accounts, that doesn't violate anything.

> Are there open source licenses that protect the contributors from such unforeseeable damage?

No, a contract or license can't absolve you from this prohibition if it applies to you.

> Or are we to watch our step from now on as open source contributors?

Yes, but not "from now on" but since before open source existed. There are entities you are not allowed to contribute to, and it's your responsibility to know and check who you are dealing with.

Even though “better 100 guilty persons should escape than that one innocent person should suffer”. Not that this was ever uncontroversial, but how did it ever go so wrong, that the very problems of government that modern laws sought to correct are gleefully recreated using private companies as enforcement proxies?

I’m not trying to directly argue that they shouldn’t, though (as long as we allow that there is no moral principle that a non-natural person’s rights follow a natural one’s). I’m saying that it’s generally accepted to be a good thing that a (branch of) government can’t directly take away your livelihood without a good reason, and if you think the reason was not good there are reasonably unbiased ways to have your disagreement considered. For the most part, this applies to a government doing it by prohibiting a private party to deal with you. On the other hand, if the same state of affairs is reached by that government merely making it potentially very expensive for a private party to deal with you, somehow none of these standards apply anymore (or maybe they nominally do but nobody’s ever succeeded at enforcing them, which amounts to the same thing). That is what gives me the chills here.

OFAC sanctions can be appealed.

And what if they did so before the sanctions? Is the US so happy to retroactively punish people who literally did nothing wrong?

What on earth did people think a tumbler like Tornado Cash was going to be used for and by?

There's nothing sinister about privacy. It would be a logical fallacy to assume that just because sinister things happen in private that privacy itself is sinister.

Totally agree. One damning aspect of Tornado is we know it was used to launder money. Criminals used it. This was publicly reported and certainly known to the Tornado team.

If you know your product is being used by criminals to do crime and you respond by shrugging your shoulders, I’m not sure what the expected outcome is supposed to be other than getting dinged.

You are aware that criminals use all the same thing as you an me right? They use toothbrush too... should Coldgate not shrug their shoulders? Sure they don't commit crime with them, but they do use them. Want something they use to commit crime? Guns to kill, cars to evade, bags to carry the money, etc... what should all theses companies do? Let's go even closer, about privacy, what about balaclava manufacturer, it's the default thing considered for banks robbers, yet they still sell them!

I don't have all the details in this case, my guess is that Tornado Cash were aware that it was used by theses countries and could have stopped theses specific accounts (it would keep going for sure without their knowledge using alternative accounts obviously, just like many of theses countries still are able to get Windows illegally, but at least they would no longer be aware of theses accounts). In that case it does makes sense and I agree with the direct sanction of Tornado Cash. I would still disagree with the blanket sanction over the open source contributors, as they might have contributed without knowing it was used by sanctioned country.

Writing all that made me think of a question: do you believe contributor to Windows should be sanctioned too knowing that Windows is used in some of the sanctioned countries?

No contributors have been sanctioned. Three leaders had their GitHub accounts deleted, from what I can tell, and are trying to misrepresent that as a threat to everyone who ever touched the project.

Hiding illegal gains.

> crime happened before the laundering and that's what we should be preventing

Covering up a murder is a crime because we don’t want people helping murderers cover up.

> like this where innocent people are going to get screwed over because they utilized a tool that criminals utilized

People who used Tornado Cash aren’t getting screwed. Even the developers aren’t. They aren’t personally sanctioned. Their work, which has been used to launder money, is.

Third parties, like Microsoft, are choosing not to associate with them. (The developers who knew about the laundering, e.g. through the public announcements law enforcement made, and kept working on it are far from innocent.)

> doesn't even begin to touch on the vast majority of laundering that happens in fiat across international banks

Yes, there are other crimes.

People laundering money through banks get sanctioned and jailed. When banks make a habit of laundering money, they too get sanctioned. There is ample historical record of all of this.

Incorrect, as per sanctions putting the onus on private entities to get things right, circle has blacklisted any USDC address that has been owned by the tornado cash protocol, which means anyone using tornado cash for legit purposes will lose every dollar they had in USDC. I'm really not sure how you came to the conclusion innocent people weren't getting screwed here, but it's irrefutable that they are, unless of course your definition of guilty is someone that used tornado cash, which would be a silly definition. I've used mixers plenty for completely legit reasons. I don't want people knowing how much crypto I have and I don't want to manage tons of addresses so when I transact in open ledgers I have at times had people pay me via mixers to hide the addresses I own and thus hide how much crypto I own from people doing business with me. All completely white market business dealing with buying/selling electronics too, for that matter.

> People laundering money through banks get sanctioned and jailed. When banks make a habit of laundering money, they too get sanctioned. There is ample historical record of all of this.

Incorrect, they pay fines that rarely even cover the profits they made to begin with.

Wasn’t aware of that. Fair enough. Innocent people will get harmed.

That said, innocent users whose USDC was frozen haven’t lost their money. They’ll have to show they weren’t laundering money. When they do, they should be able get it unfrozen. If that doesn’t work they can pursue legal remedies, though the law in all of this is obviously undeveloped. We are in dire need of stablecoin legislation; something to add might be controlled redemption for users the issuer no longer wishes to associate with.

Their situation is analogous to getting money stuck at PayPal. If you don’t want to take that risk, don’t use PayPal. If you don’t want to run the risk of your stablecoin getting stuck, don’t use mixers. Particularly after they’ve been publicly identified for laundering money.

People have been talking about all of this for years. It was continuously shouted down, or claimed to be impossible because blockchains are above the law or something. I get that there was a lot of noise above that signal. But like, it’s North Korea. On the balance of harms, of course this is what happens. There was never another endgame. The wheels of justice just turn slower than bullshitters spin yarn.

I hope you're right, but the process to make this happen will be painful and slow and the damages will not be compensated I suspect.

> If you don’t want to run the risk of your stablecoin getting stuck, don’t use mixers. Particularly after they’ve been publicly identified for laundering money.

Following this logic, should people stop using HSBC or any of the top international mega-banks? We're talking about banks that didn't "accidentally" let money laundering happen. They actively facilitated it. HSBC specifically laundered money for one of the most violent cartels in the world and not a soul went to jail.

Bit of a rant, but my point is that exactly where should people keep their money that is safe from being caught up in laundering? Such a place doesn't exist as far as I'm aware.

Practically speaking? HSBC laundered $881 million in 2012 – but they had trillions of dollars of assets under custody. They may have to pay a big fine, but your ability to get at your money will not be impacted.

And even if you deposited your money into your account at "Money Laundering Bank N.A." where everyone but you was a specially designated national, you still have legal recourse to those funds backed by decades of case law. That same case law might help you if you keep money from a mixer in stablecoin that becomes frozen, but it's going to get way hairier.

Nothing wrong with writing code. Code is speech, that's settled law. But the Tornado Cash team wasn't just publishing. They were building a tool. Semenov styled himself as a co-founder and the group advertised open positions on its website.

It doesn’t. Tornado was used to launder money. That’s all that matters.

My guess is the only people in real legal jeopardy are those who kept working on it after its involvement in laundering was exposed. (I’m assuming they weren’t in on the laundering.) For GitHub, figuring out who those people are is impossible. So they’re being cautious and cutting ties more broadly.

There is a creep problem to sanctions. Some companies in Russia are banned. Suddenly everyone from Cyprus is under extra scrutiny, since you don’t want to be the dupe they used to launder their money. Tornado and its developers were those dupes. But it has been illegal to help North Koreans launder money since before Tornado was founded. It remained illegal when it became known North Korea used Tornado to launder money. Anyone going into money services knows, or is negligent in not knowing, that these laws apply to them. It’s tough to have sympathy for anyone who kept ties. Particularly when the punishment, so far, is simply ostracism.

The US didn't mandate deletion of their Github account. The US isn't punishing them – you can tell because they didn't put them explicitly on the SDN list.

Microsoft made the choice to remove their accounts. Their compliance team likely looked and said "$ we make from these devs < $$$ we'd pay to our lawyers to simply decide if we should keep them on our platform."

This person can be totally oblivious to the illegal stuff that's happening behind the scenes. After all they were just trying to prove that they actually have experience with cryptocurrency code to potential future employers.

It also can be some random security researcher who is preventing open source developers from shipping vulnerable code. I know for a fact that Github themselves employ such people that send security-related patches from time to time to open-source projects.

You can work up more examples -- my point is that people who definitely have nothing to do with any illegal activity whatsoever could exist in the list of contributors of these repositories.

It's nice that they didn't just nuke the whole contributors list, but it's still a bit unsettling.

> it's your responsibility to know and check who you are dealing with.

What can I say, duly noted.

Sometimes you just have to assume that everyone's operating in good faith.

But, you can’t just put anything in one of these agreements; the law overrides anything you might state in a contract.

Furthermore, software licenses govern the use of your code by other people. It doesn’t govern your use of the GitHub service.

Your use of GitHub is governed by the GitHub ToS. Under that agreement, they can terminate service for any reason they want. They can cancel your account if they wake up grumpy on a Tuesday and just feel like it. Or, they can terminate service because they don’t want to touch anything that might be sanctioned with a 10 foot pole.

From the Twitter thread it appears that the devs whose accounts were nuked were core contributors to a sanctioned entity. That feels fairly sensible & what a company who wants to comply with sanctions would do.

They wilfully contributed to the upkeep of a money laundering service. They should be thankful losing their GitHub account is the extent of the fallout, take it as a lesson that code can cause real harm, and act more judiciously in future when it comes to contributing labour to suspect projects.

Privacy is not illegal.

Just because you find a use for a technology doesn't make the technology good. Nuclear weapons are a highly effective alternative to insect repellent, but that does not justify the general purpose use of nuclear weapons for repelling insects.

It's like saying the local brothel can't be shut down because the building could potentially be used to teach the word of the lord while the employees aren't otherwise busy. The exclusive purpose of the brothel's existence is enabling trafficking and sex work, and the benefit of any potential imaginary supplementary uses are grossly outweighed by the benefit to society of closing it down.

Privacy as such is not illegal, but that does not mean that government may not prohibit certain specific ways of achieving privacy.

There are a variety of sanctions mechanisms. Tornado didn’t have to be controlled by North Korea (it isn’t), just used by them to fall afoul of U.S. law.

The state has the power to levy taxes and prevent transactions with entities that it considers harmful (OFAC is effectively this); this is the state taking steps to do so, while GitHub is deciding that people who are attempting to evade those laws are outside the risk profile of "who we want to provide services to".

I hear the US government actually supports this method.

Cryptocurrency enthusiasts like to think that just because their transactions are done inefficiently on a blockchain, banking laws don't apply to them. Of course they apply. The only difference is their transactions are more expensive.

Operating an illegal money transmitter that demonstrates no capability/intent to actively filter OFAC specified sanction targets, however, is.

And no, things like monero and zcash aren't a working solution to this problem either, that's a whole different discussion though.

Things like the Bank Secrecy Act are only there to guarantee a level of secrecy/protection from other customers. Law enforcement, government, and third party service providers are not counted there realistically. If you want financial privacy, you keep your own books. By that same token though, you don't get to act surprised when the authorities come a knocking with a warrant to crack open your books when they find out you made a poor decision of people to work/transact with.

Surely you accept that illegal trade happens through cash and even through banks, so you will agree that there is some level at which you cannot ban an entire system.

[0] FBI/CIA/etc

If you are affected you could take this to court, and might even be able to convince them that the law went too far in incentivizing GitHub to delete your account. It seems very unlikely, but with a good lawyer courts can do weird things. If you do pull this off, then that would change court precedent, and when combined with a few dozen other cases eventually make it so courts will not accept deleting all accounts as a useful to to prove attempting to comply with the law. (Let me be clear, I doubt you could win this case, but it is theoretically possible so I offer it for completeness sake)

This matters a great deal when it comes to OFAC sanctions. The value of sanctions isn't "OFAC chasing down people on the SDN list", it comes from companies following federal law and blocking transactions that legally need to be blocked. And OFAC recognizes this – just look at their enforcement actions[0] and you can see examples where companies that build internal compliance programs and self-disclose violations come out with limited to no penalty[1], whereas companies that skirt compliance regimes place themselves at much more risk[2].

[0]: https://home.treasury.gov/policy-issues/financial-sanctions/...

[1]: https://home.treasury.gov/system/files/126/20220721_midfirst...