Written by: ZHIXIONG PAN
Can immutable smart contracts be subject to sanctions? This is the core issue faced by the Fifth Circuit Court of Appeals in the Tornado Cash case.
Yesterday, the court ruled that the U.S. Treasury's Office of Foreign Assets Control (OFAC) exceeded its authority in sanctioning Tornado Cash. This ruling is not only a victory for the plaintiffs but also ignites a discussion about technological neutrality and legal boundaries.
The rise of blockchain technology has brought a revolution in privacy and decentralization but has also come with regulatory challenges. When the privacy tool Tornado Cash became the focus of money laundering controversies, the U.S. Treasury imposed severe sanctions on it.
However, the court's ruling pointed out that the immutable smart contracts of Tornado Cash do not fit the traditional legal definition of 'property'. These smart contracts are decentralized, self-operating, and uncontrollable codes that cannot be owned or exclusively used. Therefore, listing them on the Specially Designated Nationals and Blocked Persons List (SDN List) was deemed to exceed the legal authority.
The impact of this ruling goes far beyond the case itself. It involves not only the legality of blockchain privacy tools but also significant issues concerning technological neutrality and legal adaptability. The court's ruling points the way for future legislation and regulation—distinguishing the attributes of technology itself from the behavior of malicious users, to avoid overly expanding the power of administrative agencies due to the neutrality of technology.
In fact, there are many details and content in the ruling document that are worth paying attention to.
Who are the plaintiffs?
These plaintiffs claim to be users of Tornado Cash, but they are all users of Ethereum and the crypto ecosystem. They come from security audit teams, Coinbase, client developers, hardware wallets, etc., and are supported by the Coinbase legal team. They are:
Joseph Van Loon (Auditware, former Apple)
Tyler Almeida (Coinbase)
Alexander Fisher (Angel Investor)
Preston Van Loon (Ethereum core developer and Offchain Labs / Arbitrum)
Kevin Vitale (GridPlus)
Nate Welch (former zkSync, Coinbase)
Who is the defendant?
U.S. Department of the Treasury and Treasury Secretary Janet Yellen
Office of Foreign Assets Control (OFAC) and OFAC Director Andrea M. Gacki
Why did the plaintiffs file a lawsuit?
The plaintiffs filed a lawsuit against the defendant, questioning its authority to classify the immutable smart contracts of Tornado Cash as 'property' and impose sanctions, violating the International Emergency Economic Powers Act (IEEPA) and the Administrative Procedure Act (APA).
The plaintiffs argue that these contracts are self-operating decentralized codes that cannot be controlled or owned and therefore should not be subject to sanctions.
Which court made the ruling?
The United States Court of Appeals for the Fifth Circuit is equivalent to an intermediate court, which is the federal appellate court. Above it is the Supreme Court of the United States, which is at the top of the entire federal judicial system and is the final adjudicating body. Only a few cases can enter the Supreme Court through appeals or special permits (such as writs).
What was the outcome of the court's ruling?
The court ruled that the defendant (OFAC) violated the International Emergency Economic Powers Act (IEEPA) by sanctioning Tornado Cash because immutable smart contracts do not fit the definition of 'property'.
The court believes that these smart contracts are decentralized, self-operating, and uncontrollable codes that should not be subjected to sanctions. Meanwhile, the court pointed out that although the technology may be abused, administrative agencies do not have the authority to expand the scope of sanctions beyond what is prescribed by law. Ultimately, the court overturned the sanction decision and called for legislative bodies to address legal gaps regarding emerging technologies.
Why do the plaintiffs want to help Tornado Cash file a lawsuit?
Although these six plaintiffs are not developers of Tornado Cash, they stated that they are users of Tornado Cash and expressed the need for Tornado Cash to enhance privacy and be used in legal contexts.
For example, Tyler Almeida anonymously donated through Tornado Cash to support Ukraine, fearing retaliation from Russian hacker organizations if the transaction was tracked. Meanwhile, Kevin Vitale turned to Tornado Cash to protect privacy after discovering that someone had linked his cryptocurrency activities to his actual address. Other individuals expressed similar concerns.
Immutable is a core keyword; how is it defined?
In this case, there were many discussions, definitions, and summaries surrounding the word immutable, which essentially recognized the uniqueness of decentralized systems and this new technology of smart contracts. The court also acknowledged that this uniqueness of decentralized technology presents unique challenges to the existing legal system.
The final ruling of the court is:
Because these immutable smart contracts are not ‘property’ under the word’s common, ordinary meaning or under OFAC definitions, we hold that OFAC exceeded its statutory authority.
Because these immutable smart contracts do not constitute 'property' under either the common, ordinary meaning or OFAC definitions, we hold that OFAC exceeded its statutory authority.
It was also added that,
The immutable smart contracts at issue in this appeal are not property because they are not capable of being owned.
And as a result, no one can ‘exclude’ anyone from using the Tornado Cash pool smart contracts.
The immutable smart contracts involved in this case are not property because they cannot be owned.
Therefore, no one can 'exclude' others from using the Tornado Cash smart contracts.
The court's definition of immutable smart contracts is:
A mutable smart contract is one which is managed by some party or group and may be changed.
An immutable smart contract, on the other hand, cannot be altered or removed from the blockchain. Importantly, a mutable contract may be altered to become immutable. But that is an irreversible step; once a smart contract becomes immutable, no one can reclaim control over it.
A mutable smart contract is one that is managed by certain individuals or groups and can be changed.
An immutable smart contract, on the other hand, cannot be changed or removed from the blockchain. It is important to note that a mutable smart contract can be changed to an immutable state. But this is an irreversible process; once a smart contract becomes immutable, no one can regain control over it.
But what if hackers are really using Tornado Cash for money laundering? There is currently no solution.
North Korea's Lazarus Group stole nearly $1 billion in cryptocurrency through hacking and needed to hide the source of funds through mixers to complete money laundering. Therefore, OFAC accused Tornado Cash's mixing function of being used for money laundering, claiming that over 65% of the laundering by Lazarus Group in 2021 was through mixers, and Tornado Cash was one of the main tools.
Thus, Tornado Cash was accused of having an indirect connection to the money laundering activities of the Lazarus Group, and was also placed on the sanctions list.
The court also acknowledged that although the Lazarus Group used Tornado Cash, this should not serve as a legitimate basis for sanctioning the entire protocol. Because immutable smart contracts do not belong to the traditional concept of 'property' or 'services', the entire protocol cannot be sanctioned due to the abuse by certain users (like the Lazarus Group).
Thus, OFAC's actions exceeded the legal authority. The court called for solutions through updating laws rather than expanding the existing sanctions framework.
The legislation of IEEPA was in 1977, long before the modern internet.
Previously, OFAC's main legal basis for sanctioning Tornado Cash was the International Emergency Economic Powers Act (IEEPA), but the court also stated, "IEEPA's legislation was in 1977, long before the invention of the modern internet."
IEEPA grants the U.S. President the power to impose economic sanctions on foreign-related 'property' when national security, economic, or foreign policy is under 'unusual and extraordinary threat'. OFAC regarded Tornado Cash as an 'entity' and categorized its smart contracts as tools related to cybercrime organizations such as North Korea's Lazarus Group.
But the court emphasized that modifying laws to address the challenges of new technologies is the responsibility of Congress, not the judiciary filling gaps through expansive legal interpretations. The court rejected the Treasury's attempt to expand administrative authority through judicial processes.
Finally
The significance of this ruling lies not only in the legality of the privacy tools behind Tornado Cash but also in delineating clear legal boundaries for the entire blockchain industry and the development of decentralized technology. The uniqueness of immutable smart contracts was deeply discussed in this case, and the court's ruling provides important judicial support for the legitimate use of similar technologies in the future.
Meanwhile, this also poses new challenges for regulatory agencies: how to effectively curb its potential illegal uses while protecting technological innovation and privacy.
After all, this is a very attractive technology, and these two sentences in the ruling document illustrate the uniqueness of this technology well:
Simply put, regardless of OFAC’s designation of Tornado Cash, the immutable smart contracts continue operating.
Even with the sanctions in place, "those immutable smart contracts remain accessible to anyone with an internet connection."
In simple terms, regardless of whether OFAC lists Tornado Cash in the sanctions list, these immutable smart contracts will continue to operate.
Even if the sanctions are in effect, "these immutable smart contracts remain open to anyone with an internet connection."