Tornado Cash is no “golem.” It’s a tool for privacy and free speech.
A rebuttal of a recent article in Lawfare by Henry Farrell and Bruce Schneier
In a recent article in Lawfare, Henry Farrell and Bruce Schneier defend sanctions imposed on Tornado Cash, a privacy tool on the Ethereum network. They argue that these sanctions are not restraints on free speech because Tornado Cash is not merely published code, but an autonomous actor designed to undermine the law, and they question whether such a thing is subject to First Amendment protection. Unfortunately the article is riddled with incorrect assumptions and mischaracterizations of the technology, the law, and the views of the sanctions’ critics.
Farrell and Schneier’s main argument is that Tornado Cash is analogous to a golem, an animated clay creature from Jewish mythology that wreaks havoc autonomously. They characterize the Office of Foreign Asset Control’s (OFAC) recent sanctions against Tornado Cash as reasonable regulation. And they characterize opponents of those sanctions as zealous anarchists.
None of these characterizations is fair or accurate.
Tornado Cash is merely a software-based privacy tool and it only ever does what its users want it to do. OFAC’s sanctions are a full and unequivocal ban on Americans’ freedom to use that tool, even for legitimate privacy reasons. Opponents of the sanctions are standing up for the rule of law and against the arbitrary and overbroad misapplication of our nation’s sanctions regime.
Mischaracterization One: What is Tornado Cash?
Tornado Cash is a free software tool that’s available at 20 Ethereum addresses. The nature of that software and of the Ethereum blockchain means that the Tornado Cash tool is as unchangeable and uncensorable as the Ethereum blockchain itself. Indeed, it’s helpful to think of Tornado Cash as a mere extension of the Ethereum protocol: Ethereum allows you to send tokens from address to address, and Tornado Cash allows you to do that with privacy. Neither Ethereum nor Tornado Cash requires you to put your trust in anyone while transacting, and neither allows any third party to control your assets while you transact.
“Tool” or “software” are the most straightforward ways to characterize Tornado Cash. Nonetheless, Farrell and Schneier variously refer to Tornado Cash as a “platform,” “entity,” “DAO,” and “golem,” never settling on any one of these often contradictory and confusing characterizations.
The golem metaphor certainly offers up shock value, but little else. If Tornado Cash was truly like a golem, then we’d be in a grave situation akin to the invention of strong artificial intelligence or the discovery of supernatural forces. Tornado Cash is much more mundane than all that. It’s just a tool. Unlike the fairy-tale golem – an animated and malevolent force – Tornado Cash is an inert tool, like a screwdriver or an envelope. And like any tool, its utility is dependent upon its use by individuals.
When, for example, a person wishes to donate money to organizations supporting the defense of Ukraine, she can use the Tornado Cash tool to send cryptocurrency without worry that Russian hackers will identify and target her. Throughout the process, the donor has control over the tool and the tool only does what she wants it to do. It’s true that Russian officials may not like what the user is doing with that tool, and may want control over the tool in order to stop her from donating to their enemy, but this is not at all equivalent to the tool being “self-executing” or a clay-statue come to life “doing terrible things.”
At the start of their golem discussion, Farrell and Schneier introduce another term, “DAO,” that they previously had not used to describe Tornado Cash. DAO, or decentralized autonomous organization, is a term that has come to mean associations that are mediated through blockchain transactions between human participants rather than through legally binding contracts. Farrell and Schneier take pains to pillory that term, selectively quoting Gavin Wood’s 2014 presentation about “allegality” (Wood’s word for technological indifference to law). While Wood did, indeed, claim that DAOs would be services that “cannot be shut down. Not by a court, not by a police force, not by a nation state.” His point, however, was focused simply on the widespread distribution, transparency, and availability of free software tools, not some malevolent or autonomous “will” that’s embedded within them. Later in the same presentation Wood analogizes the rise of these tools to VCRs and recreational marijuana. The widespread popularity of those things is what makes them difficult to stop; you have to apprehend every individual illegally recording a film or smoking a joint.
Wood’s talk is controversial, but doesn’t deserve the one-sided characterization offered by Farrell and Schneier. Towards the end, Wood even stresses the need for mutual respect between governments and persons experimenting with new technologies, the need for education, and evidence-based policy decisions rather than knee-jerk responses driven by prejudice, hollow moralization, and—presciently—the demagogic use of myths (like golems).
Either way, this ominous and politically charged invocation of Wood is an irrelevant red herring in any discussion of Tornado Cash. The Tornado Cash tool itself is not a DAO. There’s no group of DAO token-holders or DAO members who control the operation of the smart contracts. There is a Tornado Cash DAO that performs non-essential activities to support continued development of Tornado Cash privacy software, however that DAO does not and cannot control the operation of Tornado Cash. Remarkably, the Ethereum address of that DAO is not one of the sanctioned addresses announced by OFAC, and none of the designations contested in pending lawsuits challenging the sanction have anything to do with that DAO. While Farrell and Schneier’s discussion of DAOs may be timely in the context of other pending legal or regulatory action (e.g., the Ooki DAO enforcement action from the CFTC), it is again irrelevant to understanding how Tornado Cash functions or why it’s been sanctioned.
At one point, Farrell and Schneier characterize Tornado Cash as “self-executing code that exists only as software.” This is closer to the mark but still confusing. The Tornado Cash software is, indeed, just software. It is not, however, self-executing. Someone who wants to use the tool can do so, and the tool, like any good nail gun or ice pick, will function as designed. That functionality, however, is hardly “self-executing.” Throughout the entire process, control remains with the tool’s user – not with the tool itself. If I dig a hole in my backyard and bury $500 dollars in it, my shovel is not self-executing; moreover, I’m the only person who’s ever likely to get that $500 back. I might have broken a law by hiding money this way, but I am the one to blame. There’s nothing mystical about my shovel that justifies a debate over whether Americans should be able to use shovels or not. Tornado Cash is the same: it’s like a shovel, not a monster made of clay.
Mischaracterization Two: What did OFAC do?
A casual reader might come away from Farrell’s and Schneier’s article with the notion that OFAC is simply regulating Tornado Cash to make sure that North Koreans or other bad actors can’t have the benefit of privacy while using Ethereum. They describe OFAC as merely “regulating activities that it deems endangers [sic] national security,” and underscore the need to weigh “legitimate reasons for seeking anonymity” against “other harms to society.” OFAC’s sanctions, however, do no such thing. The sanctions don’t regulate Tornado Cash, they make it illegal for Americans to use it—period.
“Regulation” typically refers to rules promulgated after a public process and intended specifically to modify the behavior of persons. Tornado Cash is not a person. It does not have “behavior” any more than a hammer has the tendency to push a nail when swung by a skilled operator. In this way, the concept of “regulating Tornado Cash” is rather nonsensical.
What OFAC is actually doing is banning every and any usage of the Tornado Cash tool by Americans. OFAC is not weighing “legitimate reasons for seeking anonymity” against “other harms to society,” it is making it illegal to do that weighing in the first place.
Many Americans, including Coin Center, simply want to use Tornado Cash as a tool to maintain their privacy as they use Ethereum for entirely legal and legitimate purposes. OFAC’s sanctions make it a crime for us to do so even though our usage of the tool does not involve any criminal money or any payments to criminals, sanctioned persons, or enemy governments.
Mischaracterization Three: What are the opponents to these sanctions arguing?
Farrell and Schneier lump two counterarguments to OFAC’s Tornado Cash sanctions together: First, that Tornado Cash sanctions are “a restraint of free speech” because “software programs are a form of speech” and, second, that “the Treasury Department has the authority to sanction only humans and not software.” The article only ever discusses the merits of the first claim and doesn’t explain or critique the second whatsoever.
Farrell and Schneier don’t see merit in the code-as-speech counterargument because, as they point out, OFAC is not banning publication. You have a right to publish code; you don’t always have a right to use that code to do real things in the world. Using code (action) is not the same as publishing code (speech). Certain forms of expressive conduct, like flag burning or nude dancing can be, and often is, regulated, despite some First Amendment protections. On all of this we agree with the authors, but the entire discussion is, again, a red herring.
OFAC is not merely regulating Americans’ usage of Tornado Cash, they are banning Americans from using it altogether. Farrell and Schneier offer no opinion as to whether that’s a legitimate use of sanctions powers. We believe that it’s illegitimate. The sanctioning powers delegated by Congress to the president via the International Emergency Economic Powers Act (IEEPA) are narrowly specified and limited to banning transactions with a foreign person or majority foreign entity. Congress never intended for the president to wield his IEEPA powers to ban Americans from using this or that technology irrespective of whether they are transacting with a sanctioned foreign person, and the text of the law certainly makes no accommodation for the kind of capricious and arbitrary enforcement that interpretation would require. Farrell and Schneier do not discuss or critique these arguments in any detail.
Nor is statutory interpretation the only grounds on which we question the validity of the Tornado Cash sanctions. Unequivocal bans on expressive conduct are often unconstitutional even though expressive conduct gets less protection than pure speech. This is especially true if a ban unduly effects, or “chills,” free expression through overbroad application. The breadth here is all-encompassing: OFAC’s Tornado Cash sanctions do not merely forbid Americans from paying criminals or enemy states; the sanctions forbid Americans from using the tool to privately receive their paycheck, to privately pay for a book, to privately do essentially anything on the Ethereum blockchain. Significantly, the sanctions also forbid Americans from using the tool to anonymously contribute to legitimate political and social causes and organizations. The sanctions not only burden a substantial amount of protected expression, they also impinge on the right of anonymous association (a hard-won protection originating in the civil rights movement when racist, pro-segregation governments attempted to force civil rights organizations to disclose lists of their members).
The authors also uncharitably characterize opponents of these sanctions and cryptocurrency advocates generally as “zealots” and anarchists. Like “golem,” the label “zealot” comes from Jewish history and mythology. Zealots were members “of an ancient Jewish sect that aimed at a world Jewish theocracy and resisted the Romans until AD 70.” In modern times the term has come to mean “a person who is fanatical and uncompromising in pursuit of their religious, political, or other ideals.” And what are the political ideals of these cryptocurrency zealots? According to Farrell and Schneier, nothing short of the full destruction of the state; it is “a radical effort to undermine the very idea of government authority.” This is an unfair and damaging portrait.
Many cryptocurrency advocates and users, including Coin Center and our co-plaintiffs, believe earnestly in legitimate government authority. In particular, we believe in the rule of law. We believe OFAC’s unreasonable interpretation of its own statutory authority is a threat to that rule of law and an example of extra-legal power wielded arbitrarily against law-abiding Americans who are reasonably seeking to protect their privacy and freedom online. We are not objecting to sanctions, and certainly do not think that North Korean or other cybercriminals should escape justice. We do, however, think it’s wrong to use sanction powers to target Americans who are merely protecting their own privacy and freedom of association. As Justice Douglas said, “I am not yet ready to agree that America is so possessed with evil that we must level all constitutional barriers to give our civil authorities the tools to catch criminals.”
What do the authors actually want?
Much of Farrell’s and Schneier’s article is confusing, but the most difficult passage to parse comes when they attempt to temper and limit their support for the ban. “We certainly don’t think that the U.S. government should ban DAOs or code running on Ethereum or other blockchains, or demand any universal right of access to their workings,” they say.
As we’ve discussed, the Tornado Cash privacy tool isn’t a DAO; it’s just code at 20 addresses that anyone can use to send money privately. The sanctions are not calibrated “regulation” of bad actors, they are a full ban on every American’s use of the tool for any reason.
If that’s not exactly what Farrell and Schneier say they don’t want, a “ban” on “code running on Ethereum,” then what is it? If they don’t want OFAC to ban code running on Ethereum, what do they want? Their article seems to conjure something, but it’s unclear what’s written on this golem’s head.