U.S. Treasury sanction of privacy tools places sweeping restrictions on all Americans
Sanctioned Tornado Cash smart contract is a tool, not a person.
Tornado.cash—the website and associated Ethereum addresses—has been added to the OFAC (Office of Foreign Assets Control) SDN list (the list of Specially Designated Nationals with whom Americans and American businesses are not allowed to transact).
What does this mean in practice? It means no American can send or receive money to or from those addresses without violating sanctions laws.
What is the OFAC SDN list typically meant to do? In general, it is a tool to identify persons involved in terrorism, enemy states, or other state-sanctioned activities and ensure that these individuals cannot get the benefit of the US financial system.
How is adding Tornado.cash to the SDN list different from past OFAC actions? A smart contract is a robot, not a person. It is software that resides on the Ethereum blockchain. If a contract is credibly decentralized then the original authors of that contract could be hit by a bus and the service would continue to work. As such, today’s action does not seem so much a sanction against a person or entity with agency. It appears, instead, to be the sanctioning of a tool that is neutral in character and that can be put to good or bad uses like any other technology. It is not any specific bad actor who is being sanctioned, but instead it is all Americans who may wish to use this automated tool in order to protect their own privacy while transacting online who are having their liberty curtailed without the benefit of any due process.
Even when Bitcoin addresses have been added to the SDN list in the past, the rationale for those additions is that they are under the control of persons who are engaged in sanctioned activities and the address is simply another alias for the sanctioned person. If it was the Treasury Department’s intent to sanction some group of persons who actively maintain or promote Tornado.cash, that would be one thing. This SDN entry, however, merely identifies a URL and a series of Ethereum contract addresses. Sanctioning a tool that is not an alias of any person meriting sanction is substantially different from typical usage of the SDN list. It is a ban on a technology and not a sanction against a person.
Even worse, because of the nature of blockchain transactions, an American who is sent money through the Tornado.cash address is not even able to reject the transaction, and yet may be, at that moment, technically in violation of OFAC rules.
We are still looking at the legal and constitutional ramifications. As a first pass, it’s worth noting that under Buckley v. Valeo and Citizens United v. FEC limitations on spending money raise First Amendment concerns because spending is necessary to support and communicate political speech. In Sorrell v. IMS Health Inc. the Court went so far as to invalidate a state law that made the buying and selling of prescription drug information for marketing purposes illegal on First Amendment grounds.
In this case, the sanctions laws are being used to create a limitation on spending money not merely with some person who has been found guilty of a crime or even suspected of terrorism. This is a limit on any American who wishes to use her own money and a freely available software tool to maintain her own privacy—including for otherwise entirely legal and personal reasons.
Moreover, while limitations on speech are often constitutional when applied after the fact (e.g. defamatory speech can be penalized), prior restraints on speech are typically unconstitutional. OFAC sanctions, unlike a defamation claim, operate as a regime of strict liability, meaning that no prosecutor or judge needs to make any public showing of fact to add a name to the sanctioned persons list, and transactions with anyone on that list are banned–a prior restraint–irrespective of the specific details of any particular transaction or the motivations of the transacting person. The Constitutionality of that regime as it is typically applied has not, to our knowledge, been challenged on First Amendment or due process grounds. This particular usage of OFAC raises heightened constitutional concerns because it is, again, not a ban on one non-US person’s ability to use the financial system, it is instead a ban on effectively every American’s ability to use a particular open source software tool.