In November 2018, US Department of Treasury’s Office of Foreign Assets Control (OFAC) added two Iranians to its sanctions list (known as the specially designated nationals), over a ransomware attack and blocked their access to their Bitcoin wallets. Specially designated nationals is a list of organizations and individuals with whom financial transactions and conducting business are not allowed under the US sanctions.
OFAC sanctions have long been in place, but this was the first time OFAC applied sanctions to the identified individuals’ access to cryptocurrency exchangers. Through this action, OFAC finally proved that it is indeed possible, and sometimes even required, to identify cryptocurrency exchange participants (debunking the myth of anonymization by design) and enforce a national law on cryptocurrency itself. Equally interesting was that the crypto exchanges and service providers did not react to this development in an unconventional, disruptive way. Despite the fact that OFAC sanctions are targeted and should be only applied to specific individuals in the Treasury’s Specially Designated Nationals list, the companies are now cutting off services to everyone residing in sanctioned countries, just like their brick and mortar counterparts in the financial sector over-complied with sanctions in fear of fines. Even the decentralized, disruptive blockchain could not help overcome this problem.
These actions against residents of sanctioned countries illustrate clearly that the good characteristics of technology can be trumped if innovative governance mechanisms are not in place. The real lesson of the OFAC-Bitcoin case is that we need to explore governance mechanisms that could support the liberatory features of global, disruptive technologies, rather than expecting technologies to overcome regulation on their own. As much as we are in need of disruptive technologies, we are more in need of governance mechanisms and institutions that set innovative policies for cryptocurrency transactions.
The myth of disintermediation
Cryptocurrency does not eliminate all intermediaries, but it can re-intermediate the financial sector in new ways. By re-intermediation I mean that distributive ledger technologies led to the creation of a new set of intermediaries in cryptocurrency. Cryptocurrency exchanges and wallet providers are the new intermediaries. Re-intermediation is not necessarily a terrible thing; the distributed nature of cryptocurrency is still a revolutionary achievement. The Internet saw similar developments regarding re-intermediation and benefited from the advent of market intermediaries that were more creative, less regulated and had a more entrepreneurial approach to policy and governance.
For a long time, we hoped that cryptocurrency would make established financial institutions irrelevant and we would not be reliant on government-controlled intermediaries for our financial transactions. That hope was partly based on the assumption that distributed ledger technologies alleviate the need for trust. However, conventional financial institutions were not created to be only the brokers of trust. They do various other tasks that make them valuable. They can be used as surveillance tools for governments, help governments prosecute criminals (fairly or unfairly), and help with enforcing laws. Governance of cryptocurrency either adopts these characteristics or will have to come up with innovative governance approaches to be truly disruptive.
There is no guarantee that blockchain’s technical characteristics, alone, would make cryptocurrencies radically different from banks and traditional financial institutions. Blockchain as the underlying technology of cryptocurrency is merely a technology. It is not a governance mechanism. Blockchain and its codes will not eliminate traditional institutions that are here to provide governance, nor will it be difficult to regulate without innovative governance mechanisms.
States can and will enforce their laws on cryptocurrency
Some in the Bitcoin community are treating the sanctions imposed on the Iranian nationals as if it is something new. We knew about cryptocurrency and mining being subjected to sanctions long before the recent indictment was issued. The law was already in place, but cryptocurrency wallet holders had never been placed on the OFAC list, so Iranian miners and wallet owners were not the center of attention. But since the Iranian ransomware indictment, we see more companies blocking Iranian nationals’ access to their wallets and mining.
The wallet companies have started over-complying with the regulation. OFAC only applies to individuals and companies on the specially designated national list. It does not and should not affect others. As we saw in the domain name industry, over-compliance hurts innocent, law-abiding citizens of sanctioned countries by restricting their access to services and confiscating their cryptocurrencies. In this scenario, cryptocurrency firms are not at all different from banks and traditional institutions. They react just like the same old risk-averse companies.
The bitcoin evangelists used to travel around the world and tell us how they used Bitcoin in places that were affected by sanctions and economic crisis (especially Venezuela). But was it the underlying technology, the blockchain, that made this possible? The answer is no. The governance mechanism of blockchain allowed miners to mine from anywhere in the world. It did not restrict access. Regulations still existed that could be applied to cryptocurrency but cryptocurrency firms did not comply with them.
Technology is not enough, we need innovative governance
Cryptocurrency and technologies like blockchain, combined with good governance mechanisms, could have provided better global financial governance. However, they did not succeed in eliminating intermediaries nor even making them less important. What is missing from the picture is innovative policy and governance mechanisms that can help cryptocurrency overcome the problems financial institutions faced. We need institutions that are less regulated, less centralized and don’t provide states with too much control over transactions. Cyrptocurrency on its own will not provide that.
Perhaps the future of cryptocurrency lies in re-intermediation and revolutionizing the finance industry instead of eliminating the intermediaries altogether. If we want cryptocurrency to provide a more optimal financial mechanism than banks, we need to focus on how cryptocurrency is currently governed both by States and private actors. We need to identify the rules of the game and determine if those rules are going to help with better global access to unconventional financial intermediaries. Or crypto firms might come up with innovative solutions for complying with regulations while maintaining access globally. To take the first step toward innovative governance mechanisms for cryptocurrencies, we need to acknowledge that governance is as important as technology and technology will never succeed without innovative governance institutions.
Does your boss know you wrote this?
“Through this action, OFAC finally proved that it is indeed possible, and sometimes even required, to identify cryptocurrency exchange participants (debunking the myth of anonymization by design) and enforce a national law on cryptocurrency itself.” This does not necessarily debunk any “myth” — we do not know the investigative tools used to ascertain identities, but one can imagine that it began with the known addresses being used for extortion and from there following the transaction log (https://www.blockchain.com/explorer). A cryptocurrency “wallet” is merely software tied to hardware by MAC address coupled with other inputs, with the output being anonymization through randomized hashes representing a public and private key for addressing (a process which can generate a new address for every transaction). Could it be that these exposed individuals were posting their active addresses on social media or dark web forums, and those were observed to hit the transaction trail left behind by these bad actors spreading malware? Or perhaps they were not taking other precautions such as shuffling balances between various cold storage wallets to obfuscate their trail. That would be sloppiness on the part of the fixers — not the “exchangers”, the software developers providing the wallet, nor the underlying technology itself. Either way, these individuals can generate an unlimited number of new addresses to conduct their business with and are likely able to continue to move cryptocurrency to exchanges based in countries that do not have strict Know Your Customer (KYC) laws. With that carries more risk and tedium, but it is doable. On your mention of geoblocking, ShapeShift is based in Switzerland so they must comply in order to continue to operate and no amount of innovative internet governance would change that. The promise of cryptocurrency isn’t that there is no intermediary at all — it is that you have a consensus-based system with no centralized authority and a medium of exchange not controlled by a central bank or government with the ability to print money into oblivion. The second you try to peg it to fiat currency or convert it to the same, you then cross the threshold into this mess you describe here (oh, and here: https://www.bis.org/publ/qtrpdf/r_qt1809f.htm).
Colin, thank you very much for your insightful comment. Your points are very interesting. Especially when you mention “we do not know the investigative tools used to ascertain identities, but one can imagine that it began with the known addresses being used for extortion and from there following the transaction log”. We should investigate this further. However, the reaction of crypto firms to the indictment, which was blocking sanctioned countries residents access to their wallet might be an evidence to how “traditional” cryptocurrency firms are becoming.
There’s an innovative Internet Governance System that has been designed and awaiting stakeholder feedback. I believe you will find it worthy of your time.