Author: ZHIXIONG PAN
Can immutable smart contracts be subject to sanctions? This was the core question faced by the U.S. Court of Appeals for the Fifth Circuit in the Tornado Cash case.
Yesterday, the court ruled that the U.S. Treasury Department's Office of Foreign Assets Control (OFAC)'s sanctions against Tornado Cash were excessive. This ruling is not only a victory for the plaintiff, but also triggered a discussion about the neutrality of technology and the boundaries of law.
The rise of blockchain technology has brought a revolution in privacy and decentralization, but it also comes with regulatory challenges. When the privacy tool Tornado Cash became the focus of money laundering controversy, the U.S. Treasury Department imposed severe sanctions on it.
However, the court’s ruling pointed out that Tornado Cash’s immutable smart contracts do not meet the traditional legal definition of “property”. These smart contracts are decentralized, self-running, and uncontrolled codes that cannot be owned or used exclusively. Therefore, the inclusion of them on the Specially Designated Nationals and Blocked Persons List (SDN List) is considered to be beyond the scope of legal authorization.
The impact of this ruling goes far beyond the case itself. It not only involves the legality of blockchain privacy tools, but also the important issues of technology neutrality and legal adaptability. The court's ruling points the way for future legislation and regulation - the attributes of technology itself need to be distinguished from the behavior of malicious users, so as to avoid excessive expansion of administrative power due to the neutrality of technology.
In fact, the judgment documents in this case contain a lot of details and content that are worthy of attention.
Who is the plaintiff?
These plaintiffs claim to be Tornado Cash users, but they are actually users of Ethereum and the crypto ecosystem. They are from the security audit team, Coinbase, client developers, hardware wallets, etc., and are supported by the Coinbase legal team. They are:
- Joseph Van Loon (Auditware, ex-Apple)
- Tyler Almeida (Coinbase)
- Alexander Fisher (Angel Investor)
- Preston Van Loon (Ethereum core developer and Offchain Labs/Arbitrum)
- Kevin Vitale (GridPlus)
- Nate Welch (ex-zkSync, Coinbase)
Who is the defendant?
- U.S. Department of the Treasury and U.S. Treasury Secretary Janet Yellen
- Office of Foreign Assets Control (OFAC) and OFAC Director Andrea M. Gacki
Why did the plaintiff file the lawsuit?
The plaintiff filed a lawsuit against the defendant, questioning its violation of the International Emergency Economic Powers Act (IEEPA) and the Administrative Procedure Act (APA) by listing Tornado Cash's immutable smart contracts as "property" and imposing sanctions beyond the scope of legal authorization.
The plaintiffs believe that these contracts are decentralized codes that run autonomously and cannot be controlled or owned, and therefore should not be subject to sanctions.
Which court made the ruling?
The United States Court of Appeals for the Fifth Circuit is equivalent to the intermediate court, which is the United States Courts of Appeals. Above it is the Supreme Court of the United States, which is at the top of the entire federal judicial system and is the final decision-making body. Only a few cases can enter the Supreme Court through appeal or special permission (such as a writ of certiorari).
What was the court's ruling?
The court ruled that the defendant’s (OFAC) sanctions against Tornado Cash violated the International Emergency Economic Powers Act (IEEPA) because immutable smart contracts do not meet the definition of “property.”
The court held that these smart contracts are decentralized, self-running and uncontrollable codes and should not be subject to sanctions. At the same time, the court pointed out that although the technology may be abused, the administrative agency has no right to expand the scope of sanctions beyond the legal provisions. In the end, the court overturned the sanctions decision and called on the legislature to improve the legal gaps in emerging technologies.
Why did the plaintiff initiate the lawsuit on behalf of Tornado Cash?
Although these six plaintiffs are not developers of Tornado Cash, they all stated that they are users of Tornado Cash, and they all expressed the need for Tornado Cash to enhance privacy and use it in legal places.
For example, Tyler Almeida donated anonymously to support Ukraine through Tornado Cash, fearing that he might be retaliated by Russian hacker groups if his transactions were tracked. Kevin Vitale turned to Tornado Cash to protect his privacy after discovering that someone had linked his cryptocurrency activities to his actual address. Several other people have similar stories.
Immutable is the core keyword, how to define it?
In this case, there are many discussions, definitions, and summaries around the word immutable, which is equivalent to recognizing the particularity of new technologies such as decentralized systems and smart contracts. The court also recognized that this particularity of decentralized technology poses unique challenges to the current legal system.
The final ruling of the court was:
Because these immutable smart contracts are not 'property' under the word's common, ordinary meaning or under OFAC definitions, we hold that OFAC exceeded its statutory authority.
Because these immutable smart contracts do not constitute “property” either in the ordinary, colloquial sense or under OFAC’s definition, we conclude that OFAC exceeded its statutory authority.
He also added,
The immutable smart contracts at issue in this appeal are not property because they are not capable of being owned.
And as a result, no one can 'exclude' anyone from using the Tornado Cash pool smart contracts.
The immutable smart contracts at issue in this case are not property because they cannot be owned.
Therefore, no one can "exclude" others from using the Tornado Cash smart contract.
The court’s definition of immutable smart contracts is:
A mutable smart contract is one which is managed by some party or group and may be changed.
An immutable smart contract, on the other hand, cannot be altered or removed from the blockchain. Importantly, a mutable contract may be altered to become immutable. But that is an irreversible step; once a smart contract becomes immutable, no one can reclaim control over it.
Mutable smart contracts are contracts that are managed by certain individuals or groups and can be changed.
Immutable smart contracts cannot be changed or removed from the blockchain. It is important to note that a mutable smart contract can be changed to an immutable state. However, this is an irreversible process; once a smart contract becomes immutable, no one can regain control of it.
But what if hackers are really using Tornado Cash to launder money? There is no solution for now.
North Korea's hacker group Lazarus Group stole nearly $1 billion in cryptocurrency through hacking, and needed to use a coin mixer to hide the source of funds and complete the money laundering. Therefore, OFAC accused Tornado Cash's coin mixer function of being used for money laundering. They believe that Lazarus Group used coin mixers to launder more than 65% of its money in 2021, and Tornado Cash was one of its main tools.
Therefore, Tornado Cash was accused of having an indirect connection with the money laundering activities of the Lazarus Group and was therefore also included in the sanctions list.
The court also acknowledged that although the Lazarus Group used Tornado Cash, this should not be a legal basis for sanctioning the entire protocol. Because immutable smart contracts do not belong to the traditional sense of "property" or "service", the entire protocol cannot be sanctioned because of the abuse of certain users (such as the Lazarus Group).
Therefore, OFAC's actions exceeded the scope of legal authority. The court called for the problem to be solved by updating the law rather than expanding the existing sanctions framework.
IEEPA was enacted in 1977, long before the modern Internet.
Previously, OFAC’s main legal basis for sanctioning Tornado Cash was the International Emergency Economic Powers Act (IEEPA), but the court also stated that "IEEPA was enacted in 1977, long before the invention of the modern Internet."
IEEPA gives the U.S. president the power to impose economic sanctions on foreign-related “property” when there is an “unusual and extraordinary threat” to national security, the economy, or foreign policy. OFAC considers Tornado Cash an “entity” and lists its smart contracts as tools associated with cybercrime organizations such as the North Korean Lazarus Group.
But the court stressed that it is the responsibility of Congress to amend the law to meet the challenges of new technologies, not the judiciary to fill loopholes by expanding legal interpretation. The court rejected the Treasury Department's attempt to expand executive authority through judicial proceedings.
at last
The significance of this judgment lies not only in the legality of the privacy tools behind Tornado Cash, but more importantly, it defines clear legal boundaries for the development of the entire blockchain industry and decentralized technology. The particularity of immutable smart contracts was discussed in depth in this case, and the court's judgment provides important judicial support for the legal use of similar technologies in the future.
At the same time, this also poses new challenges to regulators: how to effectively curb its potential illegal use while protecting technological innovation and privacy.
After all, this is a very attractive technology. These two sentences in the ruling document well illustrate the uniqueness of this technology:
Simply put, regardless of OFAC's designation of Tornado Cash, the immutable smart contracts continue operating.
Even with the sanctions in place, "those immutable smart contracts remain accessible to anyone with an internet connection."
Simply put, these immutable smart contracts will continue to operate regardless of whether OFAC puts Tornado Cash on its sanctions list.
Even if sanctions are in place, “these immutable smart contracts remain accessible to anyone with an internet connection.”
