Monday, April 8, 2013

Do Digital Currency Investigations Differ Any from Paper Currency Investigations?



The New York Times reported yesterday on Bitcoin, which is a peer-to-peer currency that does not rely on a centralized bank or government treasury. This year the collective value of all Bitcoins passed one billion dollars. The Times notes that Bitcoin “comes in pretty handy for people who do not want their transactions monitored.” A significant criticism of Bitcoin is how it facilitates illegal activity. For example, it thwarts enforcement of money laundering laws. Much Bitcoin activity occurs at  the Silk Road, an online marketplace for illicit goods like narcotics and firearms.

What makes Bitcoin interesting from a privacy perspective is that all Bitcoin transactions are registered in a publically-available log. This ledger shows payments as made to Bitcoin “addresses”: strings of about 33 numbers and letters. Unless someone knows your Bitcoin address, people that inspect the public ledger have no idea who is conducting these transactions. In other words, the public keys do not constitute personally identifiable information.

But, Bitcoin isn’t so different from good old paper greenbacks. To track down a particular person using Bitcoin to commit crimes, law enforcement could contact the other participant in the transaction, and get that person to disclose what they know. After all, most of the goods bought with Bitcoin are physical property, and have to be shipped to a real world address at some point. Savvy criminal Bitcoin users can use anonymization programs or use decoy addresses (analogous to what savvy criminal cash users can do) to obfuscate their trail, but of course that takes time, effort, and expertise. And then there’s the cashout. Because (at this point) not all financial transactions can be conducted with digital currency, people will need to trade Bitcoin for government-backed money, which brings them back into a world of close government regulation.

The Fifth Amendment’s protection against self-incrimination might be one area of law that becomes more relevant with Bitcoin. In re Boucher, 2009 WL 424718 (D. Vt. Feb. 19, 2009), rejected a defendant’s Fifth Amendment claim against a grand jury subpoena which ordered him to turn over a password encrypting files that the government suspected harbored child pornography. Because at the time of his arrest the defendant had accessed his hard drive in front of the arresting officers, and the officers were able to see the file names (which strongly hinted that the files would contain child porn), the court ruled that providing access to the files "adds little or nothing to the sum total of the Government's information about the existence and location of files that may contain incriminating information,” thus defeating any Fifth Amendment claim. The same result was reached in United States v. Kirschner, 823 F. Supp. 2d 665 (E.D. Mich. 2010); see also United States v. Doe, 670 F.3d 1335 (11th Cir. 2012) (finding no Fifth Amendment violation here because unlike in Boucher the government did not know what was in the encrypted files it wanted passwords for). So if the government does not have a certain amount of evidence that illegal activity is going on, they can't likely subpoena someone to decrypt their Bitcoin account. Banks would probably be a lot more willing to disclose financial transactions than would other Bitcoin users (putting aside any statutory restrictions on banks). The government could probably try to ban Bitcoin outright, but I'll leave for another day how wise or effective that would be.

At this point, it is still relatively costly and time-intensive for the government to identify illegal activity with Bitcoin and then track down participants in this activity. Still, people enthusiastic about financial privacy should hesitate before uncritically plunging into the world of Bitcoin.

6 comments:

  1. I'm having trouble imagining any legitimate reasons for someone to use Bitcoin beyond an extreme philosophical interest in financial privacy. Lets be honest: it seems as though Bitcoin's primary purpose is to facilitiate illegal drug and child pornography sales, illegal gambling, tax evasion, and money laundering. Given the exposure it got in 2011 in NPR's great Planet Money piece (http://www.npr.org/blogs/money/2011/08/24/138673630/what-is-bitcoin), it's surprising that state & federal legislatures haven't tried to end Bitcoin already.

    ReplyDelete
  2. I have read some justifications for Bitcoin are its insulation from inflation, bank defaults, government intrusions. I agree with Emily, though, and struggle to imagine legitimate transactions where Bitcoin would be the preferred currency. I stumbled across an interesting presentation on Bitcoin that seemed to sum up what can actually be purchased with it (at least originally):

    http://www.businessinsider.com/presentation-what-is-bitcoin-2013-3#so-whos-actually-accepting-bitcoins-when-they-first-came-on-the-scene-pretty-much-only-programmers-or-gamers-were-21

    I imagine the market has since expanded, but the nature of the transactions seem to have remained the same - those that wish to remain unknown. I wonder how state & federal legislatures could regulate something like Bitcoin. Since currency derives its value from what the consumer places on that particular medium, it seems very tricky to essentially regulate what consumers value.


    ReplyDelete
  3. People relying on these transactions for privacy also face a problem we've touched on in class, namely traffic analysis. This method developed during world war 2 when it was realized that the 'handles' of wireless operators could be identified but the message send could not be read (due to the cyphers. Traffic analysis allowed the identification of troop movements, etc even when the messages were indecipherable. Similarly a key part of many naval operations at the time (e.g. Pearl Harbor) included taking the radio operators off the ship and having them produce the 'normal' chatter from port while the fleet traveled under radio blackout to its destination.

    The point is that you don't need to know the identies involved for traffic analysis to produce actionable intelligence. Bitcoin, with its public log provides an excellent method of monitoring illegal activities in general that is not available in cash. Even if you are only monitoring the total traffic, that is an objective measure that is not otherwise available. Couple this with cracking a few (very few) identities via public inquiry, informants, or known transactions and the whole edifice can be chipped away. A practical example of the later strategy, again from WW2, was the US transmission in a compromised code that Midway island was low on water. When a message later indicated that an unknown identifier was low on water (Magic intercept), this set the ground for the ambush of the Japanese fleet, a significant battle in the pacific.

    ReplyDelete
  4. And soon after this article was made, Bitcoin loses 40% of its value. It may fulfill a privacy interest, but is vulnerable to technological attacks, as well as hoarding tendencies. The minimal transfer costs seems to be the primary draw, but lack of FDIC insurance or backing will make any losses permanent. http://news.slashdot.org/story/13/04/10/215227/bitcoin-value-collapses-possibly-due-to-ddos

    ReplyDelete
  5. I would also add that a currency needs a valuation that is amenable to the target transaction size, If I can only buy items in $200 quantities, that is a problem.

    ReplyDelete
  6. EDN, most bitcoin transactions aren't actually bought by a full bitcoin. The smallest unit is 1/100,000,000 of a coin.

    https://en.bitcoin.it/wiki/Satoshi_Nakamoto

    ReplyDelete