"Bitcoin's Dark Side Could Get Darker"

That's the title of this interesting article by Tom Simonite over at the MIT Technology review. Simonite outlines a myriad of ways that online, "smart-contract" platforms such as Ethereum may be used to facilitate activities that, at best, are difficult to regulate, and at worst, are criminal.

From the article:

In a paper to be released today, Juels, fellow Cornell professor Elaine Shi, and University of Maryland researcher Ahmed Kosba present several examples of what they call “criminal contracts.” They wrote them to work on the recently launched smart-contract platform Ethereum. 

One example is a contract offering a cryptocurrency reward for hacking a particular website. Ethereum’s programming language makes it possible for the contract to control the promised funds. It will release them only to someone who provides proof of having carried out the job, in the form of a cryptographically verifiable string added to the defaced site. 

Contracts with a similar design could be used to commission many kinds of crime, say the researchers. Most provocatively, they outline a version designed to arrange the assassination of a public figure. A person wishing to claim the bounty would have to send information such as the time and place of the killing in advance. The contract would pay out after verifying that those details had appeared in several trusted news sources, such as news wires. A similar approach could be used for lesser physical crimes, such as high-profile vandalism.

Admittedly, not all uses of bitcoin and smart-contract platforms are criminal. But many non-criminal uses may still be very difficult to regulate. The article concludes:

“The potential for Ethereum to alter aspects of society is of significant magnitude,” says Wood. “This is something that would provide a technical basis for all sorts of social changes and I find that exciting.” 

For example, Wood says that Ethereum’s software could be used to create a decentralized version of a service such as Uber, connecting people wanting to go somewhere with someone willing to take them, and handling the payments without the need for a company in the middle. Regulators like those harrying Uber in many places around the world would be left with nothing to target. “You can implement any Web service without there being a legal entity behind it,” he says. “The idea of making certain things impossible to legislate against is really interesting.”

Silk Road Investigators Charged With Money Laundering and Wire Fraud

From the New York Times:

On the so-called dark web, drug dealing and other illicit sales have thrived in recent years, the authorities have said, through hidden websites like Silk Road and hard-to-trace digital currencies like Bitcoins. 

On Monday, the government charged that in the shadows of an undercover investigation of Silk Road, a notorious black-market site, two federal agents sought to enrich themselves by exploiting the very secrecy that made the site so difficult for law enforcement officials to penetrate. 

The agents, Carl Mark Force IV, who worked for the Drug Enforcement Administration, and Shaun W. Bridges, who worked for the Secret Service, had resigned amid growing scrutiny, and on Monday they were charged with money laundering and wire fraud. Mr. Force was also charged with theft of government property and conflict of interest.

The complaint can be found here. It alleges that in the course of their investigation into the Silk Road site, the agents obtained hundreds of thousands of dollars in bitcoins which they then deposited into their personal accounts.

Greenberg on "Crypto-Anarchists" Cody Wilson and Amir Taaki

At Wired, Andy Greenberg has an excellent article on "crypto-anarchists" Cody Wilson and Amir Taaki. Wilson and Taaki are involved in projects like Dark Wallet that would make digital currencies like Bitcoins hard, or impossible, to trace. Wilson is the person behind Defense Distributed, the company that made the first gun entirely out of 3D printed parts. The article describes how Taaki and Wilson got involved with their endeavors and details their projects and goals.

From the article:

Dark Wallet also offers what it calls “stealth addresses” that allow a user to receive bitcoins at an encrypted address, where only he or she can retrieve them using a private key. When a coin passes through either a CoinJoin transaction or a stealth address, it becomes vastly more difficult to track, making taxation, regulation, and prosecution virtually impossible. “We want a bitcoin that laughs at the regulatory pageantry,” Wilson says. “We’re going to permanently problematize bitcoin’s reputation.”

. . . 

“Everywhere there’s a computer, there would be the promise of a gun,” [Wilson] told me when we first spoke in 2012. “I see a world where contraband will pass underground through the data cables to be printed in our homes as the drones move overhead. I see a kind of poetry there. I dream of this very weird future and I’d like to be a part of it.”

Wilson and Taaki pursue a vision of a world where people have "tools that make illegal behavior so commonplace and technically trivial that the law ceases to be relevant." People who agree with this vision embrace technologies like Bitcoins and 3D printers because these technologies upset existing legal regimes and therefore resist traditional regulation.

The interest in circumventing laws with new technology is not restricted to idealists like Wilson and Taaki. The article points out that groups promoting terrorism have specifically identified Dark Wallet as a useful tool for funneling illegal funds. Digital currencies like Bitcoins are increasingly used for illegal activities such as the sale of drugs and child pornography.

Wilson and Taaki's ideal of undermining traditional laws illustrates why governments need to develop regulations for emerging technologies, or adapt existing regulatory schemes to apply to new technology. Law has often lagged behind technological advances, but the need to bring law up to speed gains new urgency when those behind the development of technology are actively seeking to bypass regulations.

Additionally, this article illustrates the particular importance of legal scholarship that tries to answer questions about regulating new technology. Not only will this scholarship tend to be novel, but it will be useful, since legal scholarship on bitcoins, 3D printing, and other emerging technologies will be the first arena where legal questions about these new technologies are presented and answered.

"MtGox Finds 200,000 Missing Bitcoins in Old Wallet"

That is the title of this BBC report:

The firm said it found the bitcoins - worth around $116m (£70m) - in an old digital wallet from 2011. 

That brings the total number of bitcoins the firm lost down to 650,000 from 850,000. 

MtGox, formerly the world's largest bitcoin exchange, filed for bankruptcy in February, after it said it lost thousands of bitcoins to hackers. 

"MtGox had certain old-format wallets which were used in the past and which, MtGox thought, no longer held any bitcoins," said Mt Gox chief executive Mark Karpeles in the filing. 

However, "on March 7, 2014, MtGox confirmed that an old-format wallet which was used prior to June 2011 held a balance of approximately 200,000 bitcoins," he said.

This is a bit of good news for MtGox's creditors, who previously were facing the prospect that almost all of MtGox's bitcoins had been stolen. But it casts even more doubt on how MtGox was running its business, since MtGox was apparently able to lose track of 200,000 bitcoins. This, on top of earlier revelations that MtGox continued to allow bitcoin trades when it knew that it did not have enough bitcoins to give back to their customers, makes MtGox a cautionary tale of just how much can go wrong in the world of bitcoin exchanges.

Class Action Lawsuit Against Mt. Gox Likely

News in the world of bitcoins has been dominated by the collapse of Mt. Gox, the world's largest bitcoin exchange. Investors' bitcoins that were stored with Mt. Gox were apparently stolen by hackers, resulting in the loss of $460 million. Wired has a thorough account of the hack, and the events leading up to the collapse.

Like many hacks on bitcoin exchanges, this story has drawn the attention of news outlets across the world, and has prompted some bitcoin critics to announce the death of the currency. Bitcoin enthusiasts are quick to respond that the currency is resilient and will survive this crisis. I am inclined to agree with this view, since bitcoins have survived previous hacks of exchanges, and attempts by governments to restrict the currency.

But Mt. Gox's collapse and bankruptcy is an event worth noting and continuing to follow, especially in light of the potential for lawsuits against the exchange. The Telegraph reports that hundreds of Mt. Gox customers are seeking to launch a class action lawsuit against the exchange. And the New York Times reports on the difficulty of embarking on such a lawsuit, given the immaterial and evasive nature of bitcoins as assets.

The collapse of Mt. Gox will almost certainly lead to litigation. It will be interesting to see how this litigation proceeds, and whether the plaintiffs have any success in recovering their assets.

Will the Silk Road 2 Bitcoin Hack Give Rise to Negligence Lawsuits and Would this Litigation Succeed?

The BBC reports:

The anonymous online marketplace Silk Road 2 says it has been hacked resulting in the loss of all its customers' bitcoins. 

An administrator for the site said hackers had manipulated computer code enabling them to withdraw $2.7m (£1.6m) worth of the virtual currency.

It follows similar attacks on two exchanges that trade in bitcoins earlier in the week. 

Silk Road 2 is known for selling drugs and other illegal items. 

The site is only accessible through Tor, a network that allows users to browse anonymously online. The virtual currency Bitcoin is often used in transactions as it also grants users a degree of anonymity.

This incident may be particularly interesting to watch because of the notable degree of ineptitude demonstrated by the website's administrator, known (ironically) as Defcon. Defcon should have known that the website was vulnerable to this type of hack because an earlier, similar attack on the Slovenia-based bitcoin exchange firm, Bitstamp, occurred only a few days earlier. That hack made international news, with the BBC reporting about the attack and its underlying mechanics here.

Defcon himself admitted that he should have been taking more precautions:

"I should have taken MtGox and Bitstamp's lead and disabled withdrawals as soon as the malleability issue was reported. I was slow to respond and too sceptical of the possible issue at hand," he said in the forum posting. 

In an article for CoinDesk, a news site for digital currency, Danny Bradbury an expert on Silk Road, said that bitcoin-based sites should put "bitcoins under management in cold storage (ie stored offline) so that they could not be stolen by online attackers." 

Defcon said that all its customers' bitcoins were being stored online because of planned relaunches of some of the site's features. 

"In retrospect this was incredibly foolish, and I take full responsibility for this decision."

Several Silk Road 2 users suspect that Defcon or other website administrators may have been involved in the hack, which Defcon denies.

Even if Defcon was not maliciously involved in the hack, it seems that his administration of the website was notably foolish. The failure to halt withdrawals in light of widespread reports on Bitcoin security breaches and the storing of all customers' Bitcoins online both contributed to the success of this hack. These failures, combined with Defcon's admission that he should have taken additional precautions, set the stage for a substantial negligence lawsuit against Defcon and Silk Road 2.

As far as I am aware, there have not been many similar negligence lawsuits against Bitcoin exchanges. I am aware of one lawsuit that is pending in California against the Bitcoin exchange, Bitcoinica, following the loss of thousands of Bitcoins following a hack on the exchange. The complaint in that case is available here. And at The Verge, Adrianne Jeffries reports on obstacles that case may face here. Jeffries also reports on another lawsuit against Bitcoin exchange Tradehill, but that lawsuit apparently has proceeded to arbitration.

While the Bitcoinica lawsuit is in its early stages, potential problems with that lawsuit highlight issues that may arise in a lawsuit against Silk Road 2. From Jeffries:

The plaintiffs may face some challenges. The question of jurisdiction is not addressed, and although some of the plaintiffs live in San Francisco, Bitcoinica is now based in the UK. The suit also hopes to pull in up to 100 defendants. "Bitcoinica is an entity of unknown form and origin," says the complaint, which names three defendants and "Does 1 through 100." A representative for Intersango declined to comment. The lawyer for the plaintiffs declined to comment because his lead client could not immediately be reached.

Similar problems may arise in a lawsuit against Silk Road 2. Bitcoin exchanges operate in a world of anonymity, and it may be difficult for plaintiffs to determine the true identity and location of website administrators like Defcon.

It will be interesting to see if any lawsuits result from this recent hack. Because the facts are very favorable for a negligence lawsuit, and because millions of dollars were lost as a result of this hack, I think that there is a high possibility of legal action. If lawsuits occur, this will be a good opportunity to see how the plaintiffs and courts address the obstacles of the defendants' anonymity.

Arrests for Money Laundering in Bitcoin Transactions

The BBC reports:

The operators of two exchanges for the virtual currency Bitcoin have been arrested in the US. 

The Department of Justice said Robert Faiella, known as BTCKing, and Charlie Shrem from BitInstant.com have both been charged with money laundering. 

The authorities said the pair were engaged in a scheme to sell more than $1m (£603,000) in bitcoins to users of online drug marketplace the Silk Road. 

. . . 

Mr Shrem is accused of allowing Mr Faiella to use BitInstant to purchase large quantities of bitcoins to sell on to Silk Road users who wanted to anonymously buy drugs. 

The authorities said Mr Shrem was aware that the bitcoins were being used for such purchases, and therefore he was in violation of the Bank Secrecy Act. 

The Act requires financial institutions in the US to alert authorities to any suspicious activity that may suggest money laundering is taking place.

For some quick background: bitcoins are a virtual currency that can be purchased or generated through solving programming puzzles. The currency can be used to purchase goods or services from those who accept bitcoin payments. More background on bitcoins is available here.

Proponents of bitcoins tend to argue that the currency is favorable because it is free from the constraints of traditional currency. But this case shows that, in some cases, bitcoin exchanges may be subjected to laws that regulate the transfer of traditional currency. It will be interesting to see if more cases like this follow, and if this has an impact on the popular appeal and value of bitcoins.

"World's First" Insured Bitcoin Vault

The BBC reports on the world's first insured "vault" for storing bitcoins:

A Bitcoin storage service that insures deposits of the digital currency against loss and theft has launched in London. 

Elliptic Vault uses "deep cold storage", where private encrypted keys to bitcoins are stored on offline servers and in a secure location. 

The facility's founders say they are the "first in the world" to offer insurance for Bitcoin owners.

Providing insurance for bitcoins is an important step in the currency's quest for legitimacy.  Unlike traditional currency, bitcoins cannot typically be insured, and the BBC reports that this has led to investors losing substantial amount of moneys through theft or through accidentally discarding storage devices containing bitcoins.  I have blogged previously about the dangers of bitcoin theft, and the implications these dangers have for bitcoin investment.

While insurance may alleviate some of the risks of bitcoin theft, some instability remains.  The threat of political non-recognition of the currency, and restrictions on its investment, can have substantial impacts on the value of bitcoins.  For example, I blogged a while back about some of China's restrictions on bitcoins and their plummet in value as a result of the closure of one of China's major bitcoin exchanges.

But bitcoin advocates are persistent.  Even though China's central bank refused to recognize bitcoins, following the shutdown of the major exchange, new exchanges sprang up to fill the void.  The Financial Times reports that Chinese exchanges have gained a "dominant share" of global transactions in the currency due to the exchanges' fast adaptation to changing legal landscapes.

It will be interesting to see if more insurers are willing to underwrite bitcoin investments.  If this catches on, then risks of theft and hacking may be less of a systematic concern for the currency.

More Perils and Prospects for Bitcoin Investment

It has been an interesting and informative day for people interested in Bitcoins.

Fausto Sanchez writes at JD Supra that "Bitcoins Mean Business," and notes that even though Bitcoins are a new currency, their increase in value and the increasing attention that businesses have continued to pay to Bitcoins means that the currency may become a significant force in the market.  The article does a good job of summarizing what Bitcoins are and why they have become so popular.

Nathalie Beauregard writes, also at JD Supra, in a more measured manner.  She points out the uncertainties in Canadian law when it comes to investing in Bitcoins and highlights numerous areas of the law that will need to be clarified for those interested in investing Bitcoins in Canada.  Ultimately, she recommends holding off on Bitcoin investment in Canada until investors get clarification of the issues she highlights through prior approval or guidelines from regulators.

Meanwhile, however, The Guardian reports:

The price of bitcoin has plummeted following an announcement from China's largest bitcoin exchange that it would no longer be accepting new yuan deposits. 

BTC China said that due to action by a third-party payment provider, YeePay, it could no longer accept deposits in the Chinese currency, although it would still be able to process withdrawals. BTC's chief executive, Bobby Lee, said that YeePay gave notice on Wednesday morning Shanghai time that it would no longer provide services. 

Lee blamed government regulation for the decision. China's central bank warned in early December that bitcoin was not legally protected and had no "real meaning", and barred financial institutions from using the currency.

Further coverage on this incident from Ars Technica is available here.  Also, Dan Harris of the China Law Blog thinks that "this is the end of Bitcoin in China."  The previously-mentioned concerns arising from the regulatory uncertainty of Bitcoins in other countries and from the nature of the currency may end up being overshadowed by this incident if Harris' assessment is correct.

FBI Arrests Suspected Operator of Silk Road

The BBC reports on the story here.  Reuters further explains the breadth of Silk Road's operations here.  Summarizing Silk Road, the BBC writes:

[M]ost users would not have been able to stumble upon the site as the service could only be accessed through a service called Tor - a facility that routes traffic through many separate encrypted layers of the net to hide data identifiers.

Tor was invented by the US Naval Research Laboratory and has subsequently been used by journalists and free speech campaigners, among others, to safeguard people's anonymity.But it has also been used as a means to hide illegal activities, leading it to be dubbed "the dark web".

Payments for goods on Silk Road were made with the virtual currency Bitcoin, which can be hard to monitor.

Court documents from the FBI said the site had just under a million registered users, but investigators said they did not know how many were active.

Earlier this year Carnegie Mellon University estimated that over $1.22m (£786,183) worth of trading took place on the Silk Road every month.

The FBI has also seized 3.6 million dollars worth of bitcoins, a virtual currency used to purchase goods on the website.  The FBI reports that this is its largest seizure of the currency to date.

Silk Road's suspected operator, Ross William Ulbricht (known online as "Dread Pirate Roberts") has been charged with conspiracy to traffic narcotics.  From the facts the FBI has released, however, it looks like additional charges may be forthcoming, as the BBC notes that much of Ulbricht's income from the site was disposed of through money laundering operations, and with CNet reporting:

Additionally, the FBI's criminal complaint contains information regarding Ulbricht's purchasing of an online hitman -- something that is indeed possibly using the anonymity of Tor and visiting the more criminal corners of the Dark Net.

When a user by the name of FriendlyChemist threatened to blackmail Ulbricht for half a million dollars by posting the identities of fellow Silk Road users, the owner of the site allegedly sought a price quote for having the blackmailer assassinated.

After haggling it down from $300,000 to $150,000, or 1,670 Bitcoins at the time, the hitman accepted and later reported that the job was done. However, the FBI could not find any evidence of the purported murder and so Ulbricht has not been charged with any crime related to the incident.

This prosecution comes on the heels of Symantec's takedown of a significant number of computers in the ZeroAccess botnet which I posted about here.  All of this shows that activities involving the Dark Web may not be as easy or consequence-free as users may assume.

UPDATE: The BBC reports here on how the FBI built its case against Ulbricht.

Hacking Away at the Zombie Hordes: A Tale of Botnets and Bitcoins

The BBC reports that the cyber security company, Symantec, has disabled 500,000 computers in the ZeroAccess Botnet.

Botnets are networks of infected computers that act in tandem to carry out various illicit activities, often without the knowledge of the computers' owners.  The ZeroAccess Botnet was used to download and then generate hits on ads in order to get money from advertisers.  The Botnet was also used to generate online currency in the form of Bitcoins.  At CNet, Charlie Osborne notes that:

The security team estimates that mining the virtual currency -- which is based on mathematical equations -- is potentially the most intensive activity conducted by the botnet, and consumes an additional 1.82 kWh per day for every infected computer left on. Multiplied by 1.9 million computers, that is enough energy to power 111,000 homes each day.

That same article contains a graphic representation of the botnet's cost, which adds up to over half a million dollars each day in electricity costs, on top of the other (massive) gains from advertising fraud and bitcoin generation.

For a far more exhaustive treatment of the ZeroAccess botnet and its operations, the security company, Sophos, has a technical paper on the botnet here.

I am still unclear as to how the botnet manages to input bitcoins it generates into online exchanges without rousing suspicion.  US authorities have busted those who abuse bitcoins before, and the currency is apparently quite easy to trace.  My best guess is that ZeroAccess can also use its vast network to convert its bitcoins to cash in a dispersed manner.

On the other hand, even if authorities could tell that the bitcoins came from a botnet, this may only lead authorities to infected computers.  These computers' users would probably have no idea that their machine was part of a vast criminal scheme and prosecution of these users would probably fail (but see this article by Jennifer Chandler proposing a tort liability scheme for users whose computers are part of a botnet).

If my second theory is indeed the case, then bitcoin laundering may be easier than proponents of the currency think.  Effective enforcement techniques would need to focus on preventing the sale of the currency in order to mitigate further financial losses and removing botnet operators' incentive to engage in bitcoin generation.

ZeroAccess's scale reveals the need for more effective enforcement at the level of bitcoin exchanges.  While the number of computers Symantec has disabled are substantial, the full botnet consisted of almost two million computers, and what remains of the botnet may continue to grow -- and be more resilient to future attempts at disruption.