Is DeFi Illegal Now? Tornado Cash Case Update | Jake Chervinsky

This is, in my view, for the first time, the United States government saying the developer of an open source immutable smart contract protocol should go to prison for how someone else abused that protocol even though there was nothing you could do to stop it.

Welcome to Bankless, where we explore the frontier of internet money and internet finance. This is Ryan Shaw and Adams. David's out today, so I'm here to help you become more bankless.

Pretty hard to go bankless if they make it illegal to go bankless. On Friday, September 26th, a U.S. judge ruled that, quote, control of funds was not necessary, end quote, for money transmitter laws to apply to the Tornado Cash developer Roman Storm. This is a court case I'm referencing that we've talked about a number of times on bankless. If you're not familiar with it, we'll get into some of the details in today's episode. The question I had when I heard about this was, did they just make DeFi de facto illegal in the United States? The development of DeFi? This is a terrifying precedent, regardless. And it really begs the question, do all DeFi developers become criminals if criminals use their code? Are DeFi protocols now unregistered money transmitters? And what would that mean? Is the Department of Justice waging a war on money laundering? Or are they trying to wage a broader war on privacy and all forms of decentralized crypto? Crypto lawyer Jake Travinsky is our guest today and he shed some light on all of these questions. We've called this Tornado Cash case the most important case in history so far of our fight for crypto freedoms. I think it'll answer questions like: can code be sanctioned by governments? Can crypto developers be arrested at the whim of an enforcement official? That's what's at stake in this case. This case, and others like it, is not just about our right to financial privacy. That's important and that's part of it. But it's about our broader right to develop and run software and preserve our civil liberties in this digital age. Liberties that I'm afraid are starting to erode. We're in the expert hands of Jake to help us navigate this. The episode today was sponsored by our recommended crypto exchange, Kraken. If you have not created an account and gotten started, go do it.

There's a link in the show notes today.

Bankless Nation, very excited to introduce you once again to Jake Travinsky. He is uh probably Bankless's favorite crypto lawyer on Twitter. Um, as evidenced by the number of times he's been on the Bankless podcast, and he's here once again. He is the chief legal officer at Variant Fund. He's on the board of the DeFi Education Fund, and we're here to talk about a um a very big case, a very important case that is going on in the US right now. This is the Tornado Cash case. But first of all, Jake, welcome to Bankless.

Thanks for having me back, Ryan. Great to be here.

Do you do you need to say your typical legal disclaimer? Uh, since I've had you on enough, I I know that this uh sort of needs to be said, yes?

Yes, and and thanks for prompting me, because sometimes I forget and then halfway through I have to stop. So yes, um I am a lawyer, but um nothing I say here is intended as legal advice. So don't do or not do anything just because I talk about it here. And if you do need counsel, uh feel free to reach out and I'm happy to make a recommendation.

There you go. Jake is a fantastic lawyer, but he is not your lawyer of Bankless Nation. So just remember that. Um I want to start with this tweet. So this happened on Friday, the 26th. There was a ruling in the Roman Storm case. And at the time, I didn't know the significance of that ruling, but that's that's why I invited you on the podcast to really uh talk about this ruling. And you tweeted this out. Judge Fela, her uh ruling denying Roman Storm's motion to dismiss the indictment is an assault on the freedom of software developers everywhere. This will go down in history as a perversion of law and a travesty of justice, and it will go down on appeal if that's what it takes. Strong words, fiery words there, Jake. You are one who um, you know, I your voice on on crypto Twitter generally is is um very rational, very, very moderate, very considerate, I would say. So to hear these fiery words coming out of you.

uh is was like a kind of a wake up call for me. Can you give us the context? Why did you tweet this out and what happened on that Friday, September twenty sixth?

Yeah, happy to do that. And I appreciate your kind words. And I really do try to be as reasonable in my public statements as possible. And, you know, often there are very loud voices on either side of an issue. And, you know, in this case, I'm not just blowing hot air. I think that Judge Fayel's ruling on the motion to dismiss the indictment in the criminal prosecution of Roman Storm, one of the developers behind the Tornado Cash Protocol, is really a dangerous precedent to set for not just crypto, but for open source software development generally. So maybe let me start by giving you uh the procedural posture where we are in this case, and then we can get into what Judge Phaelow ruled uh last week in her oral ruling, not written ruling on the motion to dismiss.

That sounds good. And one one thing I want to say about this, um we'll talk about this case, the the Roman storm ruling as kind of the thing that's most recently happened. There are a series of cases that are kind of tied together in this tornado cache uh case. Some in the US, some outside of the US. We might touch upon some of the other cases. The Roman Storm one is is probably the largest going on in the US and the most significant going on in the US right now. There's almost a tornado cache versus the governments around the world, like meta case, because it's a series of cases that are all tied together. But okay, let's get into the Roman storm case, uh, the 26th, September 26th, and the ruling that was made. So can you talk about the background for that and uh tee us up here?

Yeah, happy to do that. And also we can step a little more meta than that, even and talk about just sort of the global battle for privacy as well, because that's really how all of this sort of fits in. But to zoom in first on the Roman Storm case, the government decided, and when I say the government, I mean the Department of Justice, which enforces the criminal law in the United States, decided to indict the developers behind the Tornado Cash Protocol, so that includes Roman Storm, on three different criminal charges. Conspiracy to commit money laundering, conspiracy to operate an unregistered money transmitting business, and conspiracy to violate AIBA, which is the law that uh creates all of the sanctions rules in the United States. In other words, transacting or facilitating a transaction with a sanctioned party. In this case, the Lazarus group in the DPRK North Korea. And the reason the government took such an interest in the Tornado Cash case is because, as we all know and as we were all able to see, thanks to the transparency of a public blockchain, Tornado Cash did end up being used as a mixer by some bad actors in the space, even though the vast majority of use of Tornado Cash was ordinary people who just wanted to protect their privacy on-chain. And in the course of the prosecution, as a defense lawyer would do in basically any case, Roman Storm and his counsel filed a motion to dismiss the indictment. And the industry really showed up to support that motion to dismiss. So I co-authored an amicus brief along with Amanda Tuminelli of the DeFi Education Fund, arguing why that motion should be granted. CoinCenter filed an amicus brief, the blockchain association, and many others. And in essence, the argument on a motion to dismiss an indictment is even if you accept all of the factual allegations that the government makes in the indictment, those facts do not add up to a crime. And the core of the argument in the Tornado Cash case for Roman Storm is that he is not credibly accused in the indictment of actually committing those offenses, conspiracy to commit money laundering or operate in unregistered transmitting business, money transmitting business, or violate sanctions merely because he wrote code that he put onto a blockchain that operates in an autonomous and self executing fashion, and then was abused by bad actors after the fact without his personal involvement. So that was essentially the argument that was made in the motion to dismiss the indictment. And we can dig more into the details there. But just uh yeah, go ahead, Ryan.

It seems like a clear cut argument. Um, I mean, is it a pretty clear cut argument? Is there is there precedent around this?

Well, you would hope that it would be a clear-cut argument that individuals should not be held liable for the bad acts of some other third party that they are not actually participating in. But in this case, it does get a lot more complicated for a couple of reasons. What the government did in the indictment, at least in my personal opinion, is they really conflated the ways in which Storm was involved in the Tornado Cash Protocol. They make a bunch of allegations about what Storm had done, including writing the immutable smart contracts that comprise the Tornado Cash Protocol, but not just that. They also alleged that he was operating a website, right? You can go learn about Tornado Cache online. He was operating a user interface, or at least was making updates to a user interface that people could use to access the protocol. He also was involved in creating a relayer network, which was a separate off-chain system that allowed users to better protect their privacy when they use Tornado Cache. But the government admits in the indictment that the core of the Tornado Cache protocol, the pool contracts that people actually use in order to get privacy, and that North Korea was using in this case, were not in Roman Storm's control. And that's why the argument was he can't be committing a conspiracy to commit money laundering if he literally could not conduct the transaction that constitutes money laundering, because that transaction is literally out of his control through an immutable smart contract protocol. And the same issue for operating an unregistered money transmitting business, which we should get into this a little bit later, has been pretty well defined already, not by the Department of Justice, but by FinCEN over at the Treasury Department. And the way they define this type of business just doesn't sync up with how the Department of Justice described it in the indictment.

This is a key piece here because I want folks to see this case as as I'm now starting to see it. Post this ruling and even before is because this isn't just about tornado cash. It's far broader than that. It's not even just about privacy. It is that, but it's also far broader than that. What you just said is did Roman Storm have control over an immutable smart contract is pretty key because everything that we are building in DeFi is an immutable smart contract, at least the purely decentralized things are. So you think of like the Uniswap protocol, right? It's a non-custodial smart contract that has some funds inside of it, but is outside of the bounds of the developers of the Uniswap protocol, right? It's immutable, it's on-chain. They don't control it, they can't access it. They cannot uh moderate who puts you know funds inside of the Uniswap protocol. And that's been true of Uniswap V1 all the way to V4 today. So this is broader than just privacy. It's certainly broader than just Tornado Cash. This is about all of decentralized finance, isn't it? Because a lot of this uh hinges upon this idea of you know, did Roman Storm, was he responsible for the non custodial smart contract deployment, essentially a DeFi protocol that he published on the Ethereum blockchain? Is that is that is that about right? Or what have I gotten wrong in that description?

I think you're absolutely right. And maybe a few thoughts about this. One is this really strikes to the heart of what we are trying to do in DeFi. The purpose of DeFi is to create decentralized systems that do not rely on trusting a single centralized third party in order to operate or in order for users to get access to them. The second that you reintroduce a centralized intermediary with control over a smart contract in a traditional web 2 finance kind of way, then you're not doing DeFi anymore, at least in my opinion, right? You're losing all the benefits of resilience and transparency and trustlessness and permissionlessness that is at the heart of what we are trying to build in this industry. And if you go all the way back to 2013, so let's go back in time to sort of the beginning of the analysis of this particular regulatory issue, the Financial Crimes Enforcement Network, which is a Bureau of the Treasury Department that enforces the anti-money laundering laws, recognized that this nature of a public blockchain, its decentralization and its permissionlessness was in tension with the Bank Secrecy Act, which essentially says if you are a financial institution and you're processing transactions on behalf of customers, then you have some anti-money laundering compliance obligations. You need to monitor those transactions. You need to do KYC, know your customer, identify who all your customers are. You need to identify suspicious activity, you need to report that to the government. You need to have internal controls to make sure that you as a company are following all of those rules and a number of other types of compliance obligations. Now, in the context of a decentralized smart contract protocol, there is no way to identify the users of the protocol. There is no financial institution that can comply with those obligations. But in the very early days, when folks were still wrapping their mind around what is a blockchain-based business, there were questions about whether a centralized exchange should be treated like a financial institution under the Bank Secrecy Act. And thankfully, FinCEN was maybe the only agency at any point in time to give clear guidance about when compliance with the Bank Secrecy Act was necessary. And they explained if you have control over user funds, if you are a money transmitter under their regulations, meaning you accept funds from one party and transmit funds to another party or another location, well, you're a money transmitter and you have to comply with all those regulations. And over the course of years, from 2013 all the way up to 2019, Finsen continued to give guidance about when actors in the crypto industry were or were not money transmitters under their regulations.

This all came to fruition in 2019 guidance that summed up FinCEN's entire view on this issue. And the 2019 guidance is probably the most referenced regulatory guidance of anything in crypto. It's something that all of us for the last five years in DeFi have looked to to understand do we need to KYC users of this system or not? And in my view, the 2019 guidance makes very clear that an immutable smart contract protocol is not a money transmitter, or rather, the developers of that protocol are not money transmitters by virtue of developing the protocol and do not need to register with FinCEN. Nonetheless, here comes the Department of Justice in this criminal prosecution. And their argument is we are not bound by Treasury's guidance. You all in the industry may feel like you've been following what they told you to do for the last five years. That may satisfy them, but not us. And even if you are not in violation of the Bank Secrecy Act, nonetheless, you may be violating the criminal law and you may have to go to prison for it. So that's what's happening in this case.

So that that's essentially what they're saying about Tornado Cash. And that's why this the the stakes are so much wider. The stakes are potentially all of DeFi in the United States. So can you get us to the the like and and just to to clarify my understanding of this, Jake, is like in the ruling, maybe we'll get to the ruling that that happened on that Friday in September. In the ruling, the judge, by saying that Roman Storm had responsibility, uh that Tornado Cash and his development of Tornado Cash was essentially a money transmitter, right? Then de facto is she not implying that all DeFi protocols, potentially smart contracts, could be money transmitters? Or like was this just tied to privacy? Anyway, let's get let's get to the actual ruling and what the implications might be. So, what happened in the ruling on the 26th?

Yeah. So as I said, in the motion to dismiss the indictments, there were many arguments, but the crux of the argument was Roman Storm was not operating an unregistered money transmitting business because what he was doing, offering a website, offering a user interface, writing the original code, working on the relayer network, that is not money transmission because he was not accepting funds and then transmitting funds on behalf of any other person. He never had custody over user funds. He did not have control over the protocol. And the judge basically said that is not my interpretation of the law. My view of the law is a person does not need to have control over user funds or custody over those funds in order to engage in money transmission.

And, you know, it's very important to note, first of all, that motions to dismiss indictments are very rarely granted. So, in a sense, it's not surprising that Storm lost the motion. The standard is extremely difficult to meet. Courts are very deferential to the government. They basically say, well, as long as the indictment sort of hints that there was a crime, as long as the language of the statute that alleges an offense is somewhere in the indictment, then more or less this can go to trial. But Judge Phaelow went way beyond just saying this indictment is at least sufficient to move on to trial. She actually made a holding on the core legal issue that control is not necessary to engage in money transmission. And she sort of steps back and does what I think is a bit of a sleight of hand that the government does as well, which is to describe Tornado Cash as a whole, as a service.

So she says that Roman Storm was offering a service that was the Tornado Cash Protocol, but she doesn't engage at all with the details about what that service actually might be. And I think we could all agree that, you know, Storm was offering some type of service. There was a business here. There were ways in which he was being compensated for that business, but the business was not the business of money transmission. And that's something that Judge Vela, at least in my opinion, just didn't engage with in the ruling.

Okay, so can we talk about the this term money transmission? Because we we're talking a lot about this. This court hinges upon uh the judge's definition of like what money transmission actually is and who's a money transmitter and who's not. We'll talk more about that. But like, why is that even important? So say I'm a money transmitter, Jake. Uh does this imply some level of responsibility, like culpability, uh a set of things I have to do? Uh what why is money transmission so important here?

Yes, it's a great question. And this might get a little bit in the weeds of the law, but hopefully the listeners will appreciate understanding a bit more how these different statutes play together. Exactly to your point. If you are a money transmitter, then you are a type of regulated financial institution under the Bank Secrecy Act, which is that law that the Treasury Department, FinCEN, enforces. As a money transmitter, you have to go register with FinCEN. You have to KYC all of your customers or users. You need internal controls. You need to designate a compliance officer. You need to do all kinds of reporting and record keeping under the Bank Secrecy Act. So being a money transmitter imposes a lot of compliance obligations on you under Title 31 of the US Code, which is where the Bank Secrecy Act is. Totally separately from that, you also could be subject to criminal liability under Title 18 of the US Code. That's where all the criminal laws are that the Department of Justice enforces. And Title 18 makes it a crime, specifically under Section 1960, to operate an unregistered money transmitting business. So the way that ordinarily we would think about this before the Department of Justice recently took a different position is if you're a money transmitter, but you don't register with FinCEN, you've committed two separate violations. Number one, a civil violation under Title 31 of the Bank Secrecy Act, the Treasury Department might enforce that violation against you. And number two, a criminal violation under Section 1960 of Title 18, then the Department of Justice might come and prosecute you criminally. But we all assumed that this was all or nothing, right? You've either complied with the law or you've not complied with the law and violated both of those different statutes. Here, the Department of Justice is saying, that's wrong. You can be in compliance with Title 31, following all of Treasury's guidance, and nonetheless be engaged in money transmission as we differently define it under Section 1960. And that, frankly, breaks my brain. I don't know how an industry could possibly operate when we can't follow the guidance of the Treasury Department, which is tasked with enforcing this type of statute.

So you said it's is it Title 18, 1916?

The criminal code, yes.

Is that that's the criminal code. And this is what uh Roman Storin was explicitly charged with, among other things, a violation of tit Title 18. You said that that is a a criminal charge. So when you talk about criminal charges, right, so I mean we're talking about what, like jail time? Like what are the penalties for this type of a crimin criminal charge?

Yeah, the the potential penalty for operating an unregistered money transmitting business under 18 USC section 1960 is five years in prison. And, you know, he's also accused of violating section 1956, which is uh the money laundering statute. Um, you know, you could tap on more years for that. And then there's also the sanctions violation, which again all hinges on essentially the same general allegation that Storm is liable for third party misconduct that he could not control at the time that it took place. So

These charges stack too, right, Jay?

You know, it depends on sentencing. You know, often if there is a conviction for more than one charge, the sentences end up running concurrently. So you could get three five-year sentences, but you don't serve 15 years. You know, you serve the five minus some for good behavior. This is all stuff that gets worked out in sentencing. But we are talking about the liberty of a software developer. You know, this isn't just a question of whether there could be a fine for a company or whether the business can continue operating. This is, in my view, for the first time, the United States government saying the developer of an open source immutable smart contract protocol should go to prison for how someone else abused that protocol, even though there was nothing he could do to stop it.

It's actually wild. And of course, we we don't know uh all all of the facts and all of the evidence will come out in the in the court case, and that court case will will go to trial December second. So uh I I don't think either of us are here uh saying like we know all of the facts and all of the evidence of this case, but can we talk about the circumstances through which Roman Storm was actually arrested? So someone someone hearing that might be, well, but we live in a a reasonable society. Okay, Jake, yeah, these laws are are kind of on the book, but like you you saying things like um, you know, uh DeFi developers could go to jail and uh they could be like criminals. That's not practically how the US works, right? I mean, we are a country of innovation. We we support uh developers and entrepreneurs, but can we just talk about the circumstances by which Roman Storm was was actually arrested? So um he was a privacy defied developer, right? Deployed uh Tornado Cash. We've already talked about some of the other activities that that he did in association with this deployment. My understanding, Jake, is he was actually arrested from his house somewhere in Washington State in the like early hours of the morning. I don't know if he had a family there, but like in front of his family, it was like literally arrested. So this wasn't the case of like, hey, you're getting some warnings and we'd like you to comply and you need to do XYZ, like, or else it was suddenly the FBI, a SWAT team's at his house and yoinking him and like taking him into custody. Is is is that accurate? Because that's what I seem to remember from this.

Well, I I remember the same report. Um I I don't want to scare people too much, right? I I don't want all the DeFi developers listening to this to think that men in windbreakers are gonna show up at their door at 6 a.m. tomorrow and put them in handcuffs. Cause I I don't actually think that that that's what's likely to happen. Uh and I don't want to scare anybody too much. But um

first

We don't know whether there were conversations between the Department of Justice and Storm or others at Tornado Cash or their council before there was an arrest. Frankly, it would shock me if there was no contact at all and doors got kicked down without any warning whatsoever. So I think that that's an unlikely result. Although indeed, if the government does decide to make an arrest, they usually don't tell you way in advance because they're worried that you're going to flee. And especially in crypto, you know, where it's, you know, there may be some risk of flight. I think the government uh tries not to let folks um uh know in advance that there may be an arrest. But I think if I were to steel man the government's case here, not the not the case on the facts, but in terms of how they're operating, let me give at least my my most reasonable interpretation or what I think that someone working for the Department of Justice would say if they um, you know, if they had the freedom to actually discuss this, which by the way, they don't. So we don't really know what's going on behind the scenes. I think what they would say is we are not coming after all of DeFi. And we are certainly not coming after all open source software developers. That's preposterous. We're reasonable people and we understand the world operates on open source software. We are going after people who are building tools that are being abused by our geopolitical enemies, by a brutal dictatorial regime, North Korea, which none of us should be supporting in any way. And we are only doing that because we know that the developers, and again, this is what they would say. It's not my view, but they would say where we know that the developers are aware of that illicit use of the technology that they built. And nonetheless, despite that knowledge, they are continuing to profit from their work and they're continuing to try to improve it, and they are not doing anything in their power, and there are some things potentially in their power to do to try to stop that type of illicit use. But no one else needs to be worried about this. We exercise prosecutorial discretion. And if you are trying to work with us to stop the bad guys, then you don't have to be worried about men and windbreakers coming to your house at 6 a.m. tomorrow morning. That is, I think, what they would say. My response to that is that's a nice thought. We're not here in crypto to trust the government to do the right thing. In fact, we're here to build technology that stops bad actors, whether they're in government or anywhere else, from exerting their outsized influence and power to take advantage of other people. And even if we think the government is making good decisions now, I think everyone could be worried about what a next administration looks like, no matter what side of the political aisle you're on, and whether there could be some abuse of prosecutorial discretion in the form of selective prosecution, where the government decides we're only going to go after people we don't like, and we're gonna interpret the law so broadly that there is no more rule of law. The law is if we don't like you, we're gonna come get you. And to me, that's what this legal precedent sounds like as the Department of Justice is describing their authority to prosecute software developers under Section 1960.

I mean, it's a little bit like, you know, trust me, bro enforcement.

And that's that's what's so concerning about this, because like you don't know who is on the other side of that enforcement. I'm that that's not how the legal system works. That's not how the US is supposed to be designed. We we should have a set of civil liberties that protect us from uh like this kind of enforcement. Uh uh let me ask kind of a question that's maybe somewhat of the elephant in the room. So this DeFi protocol was was uh targeted uh for privacy use cases. And to your point, the vast majority of its transactions were just people simply trying to preserve their their privacy when interacting on chain. So chains like Ethereum, of course, Bitcoin, et cetera, they don't have privacy native to the layer one. So if you want that.

Um, like any level of privacy without some third party seeing how you transact. You know, the way I might pay you a hundred dollar bill and you and I don't have to tell anyone. It's not recorded anywhere, it's not on a public ledger. We want that to maintain that cash level privacy, then Tornado Cash was an avenue to do that. Lots of people uh in in the US in crypto use this as just like a tool, include including my co-host, uh David Hoffman, by the way, who's a part of another like Tornado Cash related uh lawsuit that we could we talk about later. But anyway, the elephant in the room is of course Tornado Cache was built for privacy. There are other DeFi protocols that are a bit more general, not necessarily privacy, but uh like an automated market maker, right? Say like a Uniswap, for instance. And of course, the Uniswap lab's front end can implement whatever they want as far as you know, future KYC, future screening. They can, you know, delist assets, they can do whatever they want. But the code itself that operates any of the Uniswap protocols, right?

Is immutable on chain. Any other third party could spin up an interface. You don't even need an interface. You could trade uh tokens using kind of like command line firmware type stuff without a user interface. And there is nothing stopping any quote unquote bad actor from and it should acknowledge North Korea is absolutely a bad actor. Like acknowledge the national security concern here, like understand that piece of it, right? What we're talking about is the legal precedent this sets. But anyway, any actor can uh participate without the developer's uh permission. And so how does that like why why should this stop at Tornado Cash? Why why does this not filter down into all of the other DeFi protocols? Is there some sort of argument about proportion of like illicit bad actor use? Or is that what the judge is implying? Or is that the entire problem that this is all so vague at this point?

I think that's exactly the problem. And if you look at the criminal statute that Storm is accused of violating, operating an unregistered money transmitting business, there's nothing even in there about illicit financial activity, or at least it can apply even if there is no illicit activity whatsoever. So if you take the government's theory at it on its face, I do think you could apply it to any number of other types of DeFi protocols. Now, again, the the government is going to say that's not their intent. And their real goal and the purpose of these statutes in the first place is to give them authority to root out bad actors and money laundering. Ah, it's not the

The flexibility here, right?

That's exactly right. And Judge Fela, in her oral ruling, even said, you know, sure, technically speaking, in the past, money transmitters have had control over user funds. But I don't see that as being necessary under the statute. And I have to interpret the statute as being flexible to keep pace with novel ways that people are trying to abuse the financial system. So she's sort of admitting that she is expanding the law in a new way, but that the law is intended to cover new types of conduct so the government will have the authority that it needs to go after illicit actors. So I do think that this is a concern for everyone else. The more so though than the legal analysis. And this is so often the case with crypto because laws and regulations are so vague and hard to understand when you apply them in a decentralized permissionless environment. The question is not what the law says, the question is one of practical risk and practical calculations by the government, what they want to go after and what they don't. And when they look at something like Uniswap, a decentralized exchange protocol, that itself does not provide privacy. In other words, there's really no way to use something like Uniswap to obscure the source of funds. All the transactions are going to get traced. And so you can't launder money because you can't stop the government from tracing transactions through the protocol. The government basically says, yeah, we can trace this stuff. So we don't really feel like we need to characterize this as an unregistered money transmitter. It's when you have privacy that the government says, we are not comfortable with this. And many people have noted, so this isn't my thought, but if cash, which of course is totally private, were invented today, the government would almost certainly not want to allow it because they want to surveil all of our transactions all of the time. That's how law enforcement works in the modern world. And they are not going to give that up easily just because we built technology that doesn't require centralized intermediaries in order for us to transact at a distance.

This is so interesting. So basically, in theory, this judge's ruling, and we'll we'll talk about the significance of this judge's ruling, because this judge does not get the last say on this issue. I mean, per your tweet, and it will go down on appeal if that's what it takes. You think ultimately this will be struck down. But let's say this judge's uh theory holds, then she's basically saying if you're if you're a developer deploying an immutable smart contract and a third-party actor uses that or does something with that code, you might be a money transmitter and you might be prosecuted under Title 18, 1960 under you know, criminal charges. But practically what you're saying is the US government apparatus and the DOJ and everybody who's kind of looked at this issue, they're not at I mean, Uniswap's been in operation for a long time. DeFi's been out there for a very long time. I mean, you've you've been in this uh like industry for for as long as anyone, Jake. I mean, looking at these issues, and they're not knocking down DeFi developers' doors and and arresting them. And it's because we have this maybe uh uneasy impasse in that our layer ones and DeFi itself are transparent, are not private. And so they've kind of like not prosecuted it in the way they're coming after Tornado Cash. Where they are um like targeting is when privacy, when that when there's a layer of privacy, when they can't see in the the transaction itself, who the source is, that's what they're most worried about. And so that's where we get the ire of the US government. I guess that's kind of the the the trust me, bro, is like you're kind of trusting that the DOJ is not going to come after any of our other DeFi protocols just because they're not private, because they're public. And so we have this uneasy impasse where they have all of these powerful analytic tools and they can, you know, trace, they essentially get their AML KYC anyway. It's just in the in the in the background where they can track all these transactions. It's another quip that uh I think is is somewhat true, is like along with you know cash being you know illegal if it was proposed today. I think if Bitcoin had privacy on like the base layer of Bitcoin or Ethereum had privacy on the base layer of Ethereum, I don't know that the governments of the ra around the world would have allowed it to propagate in the way that it has. And I I sort of you know view that as a uh you know a practical matter. It seems to be when there's immutable smart contract code and privacy combined, that's when you face the full might of the five financial surveillance like government apparatus. That's what they really don't like.

I I think that's spot on and very well said. And I, you know, I should add, uh, you know, I have friends at the Department of Justice. They're very good people, right? They want to do the right thing. They they're working for the government because they believe in what they're doing. And we should be grateful that they're there because we do need them to go after the actual bad actors. And I do think, you know, one way to put it is trust me, bro. But another is to say they are trying to make good decisions about how they wield their prosecutorial discretion. The problem is what we want to see is for them to go after the actual bad guys, the people who are engaged in criminal conduct, not the people who are building neutral tools that can be used by ordinary people for totally reasonable and legitimate purposes. We want to protect privacy, right? Privacy is guaranteed to us by the Fourth Amendment to the United States Constitution. I, for one, still really like the Constitution. The Bill of Rights, my favorite part for sure. The Fourth Amendment, probably my favorite amendment. Maybe after the First Amendment, the Fifth is pretty good too, and the 14th as well. But you see what I'm saying, right? We have to balance the very reasonable goals of the folks at the Department of Justice to stop illicit activity and protect people, to genuinely protect us from bad actors with our civil liberties. What we cannot say is we will abandon privacy entirely because that will make it easier for the government to hunt down the bad guys. Because what that leads to, every single time you see the rise of an authoritarian government anywhere in the world, and we have so many concerns about authoritarianism now here in the United States, no matter where you are in the political spectrum, is the first thing they do is they take advantage of their control over the financial system and over the criminal justice system to go after their enemies, their political enemies. And if we interpret the law this broadly to give the government this much power, we have to be very worried about how they will use that power next.

Okay. Can we talk about this ruling itself? So the ruling has some um, you know, terrible implications, let's say, uh, for non custodial uh DeFi tools in general, particularly privacy, but not just um privacy. How binding is this ruling? Like where, you know, where where do we go next with this type of thing?

Yeah, so great question. And the answer is it's not binding. And not only is it not binding, but Judge Fela decided not to issue a written opinion. So all we're ever going to get is this transcript. And that means a couple things. Most importantly, for the lawyers out there who will understand this, it means the opinion won't go on Westlaw, which is the main research database that people use to look for a precedent that is persuasive, even if it's not binding. So this is actually going to be pretty hard for people to find. So it may not be that noteworthy that she decided not to write it up. The sort of downside of her not writing it is that the transcript is pretty, it's pretty vague. You know, she didn't give us the deep reasoned analysis that you would ordinarily get from a written opinion. So as you know, Ryan, when, you know, we get orders from judges, including frankly from Judge Fela, on some of the SEC's cases, right? Motions to dismiss and motions for summary judgment, they're very long, dozens of pages, lots of case citations, very deep and detailed explanations of what the basis of the ruling was. We're just not going to get that here. And in a sense, that's a blessing for us in the industry because it's not that likely that the next judge, confronted with a similar set of facts or a similar legal argument, will go to Judge Fela and just say, well, she already comprehensively dealt with this issue. So I'm just going to cite her and defer my judgment to hers. I think that's a really positive thing. Then there's the fact that this order itself probably doesn't get appealed on its own. What happens next is the case goes to trial. And the trial is currently set for early December. I think it's December 2nd. And from everything I can see, just looking at the public docket, it seems like the parties are on pace to go to trial in December. Now, obviously, who knows what will happen at trial? There will be weeks of testimony and evidence submitted to a jury, right? 12 Americans who are, you know, peers of Storm will get to decide: did the government actually meet its burden of proving beyond a reasonable doubt that Storm actually committed these offenses? And what could happen is the jury could say, found not guilty, acquitted. And that would be the end of the entire story. There would be no further discussion of any legal issue. The case would just disappear. On the other hand, if Storm is convicted, the jury finds that he committed one or more of these offenses, then you will have an appeal. And the appeal could be about any number of issues that came up during trial, including things having absolutely nothing to do with any of these issues around money transmission or government authority, right? Evidence that was submitted that shouldn't have been, or, you know, things of that nature. Also, what would likely be challenged is not the order on this motion to dismiss, but rather jury instructions that Judge Phaela will give to the jury explaining to them what the law is to help them decide whether Storm is guilty or not guilty. So we're gonna get more over time from Judge Phaela that will be challenged. And in all likelihood, this ruling on the motion to dismiss just gives us a sense of how she's gonna continue interpreting the law going forward.

And this judge is the same judge who's going to be presiding over the kind of the main case that happens in December, uh, and you're nodding your head, yes. And and the instructions she gives to the the jury, will they be instructions that like um, you know, about this non custodial versus custodial issue? In other words, will she kind of, you know, slant the jury to say, hey, still a money transmitter, you know, e even with non custodial. So you have to factor that into your analysis. I mean, in other words, can this really sway the the jury towards one interpretation of the law?

So often that is what happens. Um, we don't know what the jury instructions will look like, how many of them there will be, what issues they will be on. And the the process of figuring out jury instructions involves both of the parties. So at some point, Judge Fela will ask both Storm and his counsel, and also the government, what jury instructions do you think that I should give? You can imagine, or guess at least, that the government is going to want very strong uh authority in the jury instructions. They'll want her to instruct the jury in order to find a violation of section 1960, you do not need to find that Roman Storm had control over user funds, et cetera, et cetera. And often judges do sway a jury in the way that they give instructions. But there's no way to know that right now. For all we know, Judge Phaela will decide I don't need to give a jury instruction on this issue. I think it's totally clear all on its own. The jury can just read the statute. Um, and if they have a question, they can also send questions as they are deliberating. So, you know, this really is a long process that goes on leading up to the trial in pretrial motions practice, and then also throughout the trial, and then also as the jury is deliberating.

Wow. Okay. Um what's the worst case scenario that could happen for DeFi, for crypto coming out of this case? And what's what's kind of the the the best case scenario?

Um, I mean, at this point, the best case scenario for DeFi would be an acquittal. Um, because I think if the government just loses this case, even if there's not a legal reasoning that they get as to why, that would be a strong rebuttal to their attempt to regulate this industry through criminal prosecution of software developers. So without a doubt, that's the best thing that could happen for DeFi. I'll throw in a bit of a pitch, if you don't mind, that the best way that listeners can help Roman Storm get an acquittal is to support his defense. And hopefully, Ryan, you and I will uh tweet out or otherwise publicize links where people can make donations. Um, good lawyers are expensive, and uh, Storm does need more funding in order to make sure that he has the best representation.

You know what's crazy here, Jake? So we we have been talking about this and tweeting it out. In fact, bankless has uh donated to this cause. Um I I've heard from a number of people who are actually um afraid of donating to this case. I mean they that gives you a sense for kind of the the chilling effect that this type of case kind of brings. And I don't know if the these fears are rational or not. I mean, regardless, it is causing uh a chilling effect. Um you know, it's not illegal to donate, is is what I would say. There'll be a link in the show notes. And if you care about these issues, then uh well said by Jake. This is this is what we need to do. Um okay, what what is what is so that was the best case scenario that's acquitted. What's what's a worst case scenario?

Yeah, so and and just exactly to your point, and and this is quite sad, I think in the worst case scenario, uh Storm would be convicted. There would be an appeal on this issue that we're discussing, whether there should be some control requirement under the definition of money transmission in the criminal code. That could go up to the Second Circuit Court of Appeals. Uh, in a worst case scenario, they would affirm, meaning they would validate Judge Phaelow's ruling that control is not necessary. Um, circuit courts write opinions. A circuit court opinion going the wrong way on this issue would be uh binding in the second circuit. So the next time the government brings a case in the Southern District of New York, the judge would be required to follow the Second Circuit's ruling. Perhaps there could be appeal up to the Supreme Court. Um, it, you know, we're now talking many years down the road, and the Supreme Court doesn't take a whole lot of cases, especially when there's only one circuit court opinion on the issue. They usually look for cases where one circuit court has said one thing and another circuit court has said another thing. So everyone is aware that in different parts of the country the law is different and the Supreme Court is trying to resolve that split. We wouldn't have that, I think, in this case. Um, so it's hard to imagine Supreme Court review. Also, unlike some of the other cases we tend to bring to the Supreme Court, or at least want to in the crypto industry, where the Supreme Court is very suspicious of the administrative state and its authority, right? Where the court is limiting the ability of the SEC, for example, to assert its jurisdiction, the Supreme Court tends to be much friendlier to the government in cases involving national security and law enforcement. So it's hard to put together five Supreme Court justices who would side with us on this issue if in fact the Second Circuit has decided that control is not necessary under Section 1960. So, worst case scenario, this does become the law of the land. And like you said, folks are afraid to build immutable smart contract protocols in the United States without being told by their lawyers if you want to build this, you have to put KYC into it before you launch it. I think that's

protocol itself not just the user interface into the protocol itself right that's what a that's what a lawyer would would would say if um control is not necessary if if that becomes the precedent

I mean, I do think that's the implication here, right? And I do wonder if there are going to be some conservative lawyers out there who even hear what Judge Phaela just said and start advising their clients, you can't launch a decentralized permissionless smart contract protocol because even though you don't control it, that still might be a money transmitter. So you have to do KYC literally on chain, which I suppose could be theoretically possible somehow. But if that's what we're doing, it's not default.

any longer

And I don't, I don't think it's what motivates any of us to be here.

wow control not necessary can can I uh ask briefly um do this would seem to have implications beyond crypto of course this is a you know crypto focused podcast but we're talking about code that's published in some way in an open source way uh and um a bad actor using this code I mean does this have implications for like AI let's say like AI models and AI like generation? I mean where where does this kind of thing stop?

I think it has vast implications outside crypto. I think, you know, even before we get to AI, just think about what money transmission means if it doesn't require control or custody of user funds. Is my internet service provider a money transmitter? Because I used the internet in order to use a DeFi protocol. Does Comcast need to register now with the government and start tracing all of my transactions? So I think that even in the uh scope of money transmission, this is very dangerous.

Even before that, Jake, I think of in being an ETH validator. I mean, what is that? I mean you're certainly processing some transactions, aren't you, as as part of this? Validating them.

Absolutely. And you know, thankfully, again, FinCEN, in its guidance about money transmission, has always said miners and validators are not money transmitters. But you have to wonder if the Department of Justice is going to say, well, they're not Title 31 money transmitters, but they are Title 18 money transmitting businesses. And I just I don't know how crypto could survive in the United States if that were the case. But to your question, outside crypto, we are dealing with this, again, core issue of when a software developer is liable for a third party that misuses software that they created without their knowledge and without their participation. AI can be used for anything. Well, is the creator, the developer of the AI agent, going to be liable for everything that anyone does with that agent just because they built the neutral tool? Again, I don't think we can have a modern digital world if the government gets to target literally anybody they dislike just because they are interpreting the law this expansively.

Anyone they dislike and and even if you just say, well, it's only it's only the privacy sort of case. Well, I'm I guess my question is like, how about somebody who develops some new encryption algorithm? You know, uh ZK Snarks or, you know, RSA encryption. And this is certainly used in in you know privacy context. It's open source code. Are they on the hook for how North Korea might might use their encryption software?