Author | ZHIXIONG PAN

Original link:

https://substack.chainfeeds.xyz/p/ofac-tornado-cash

Can immutable smart contracts be subject to sanctions? This is the central question faced by the United States Court of Appeals for the Fifth Circuit in the Tornado Cash case.

Yesterday, the court ruled that the U.S. Treasury Department's Office of Foreign Assets Control (OFAC) acted beyond its authority in sanctioning Tornado Cash. This ruling is not only a victory for the plaintiffs but has also sparked discussions about technical neutrality and legal boundaries.

The rise of blockchain technology has brought a revolution in privacy and decentralization, but also regulatory challenges. As the privacy tool Tornado Cash became the focus of money laundering controversies, the U.S. Treasury imposed stringent sanctions against it.

However, the court's ruling pointed out that the immutable smart contracts of Tornado Cash do not fit the traditional legal definition of 'property.' These smart contracts are decentralized, self-executing, and uncontrollable code, which cannot be owned or exclusively used. Therefore, placing them on the 'Specially Designated Nationals and Blocked Persons List' (SDN List) is considered beyond the legal authority.

The impact of this ruling extends far beyond the individual case itself. It not only concerns the legality of blockchain privacy tools but also significant issues related to technical neutrality and legal adaptability. This ruling by the court points the way for future legislation and regulation—distinguishing the attributes of technology itself from the actions of malicious users to avoid overly expanding the powers of administrative agencies due to the neutrality of technology.

In fact, the judgment document of this case contains many details and contents worth noting.

Who are the plaintiffs?

These plaintiffs claim to be users of Tornado Cash, but they are also users of Ethereum and the crypto ecosystem. They come from security auditing teams, Coinbase, client developers, hardware wallets, etc., and have the support of Coinbase's legal team. They are:

1. Joseph Van Loon (Auditware, former Apple)

2. Tyler Almeida (Coinbase)

3. Alexander Fisher (angel investor)

4. Preston Van Loon (Ethereum core developer and Offchain Labs / Arbitrum)

5. Kevin Vitale (GridPlus)

6. Nate Welch (former zkSync, Coinbase)

Who is the defendant?

1. U.S. Department of the Treasury and Treasury Secretary Janet Yellen

2. Office of Foreign Assets Control (OFAC) and OFAC Director Andrea M. Gacki

Why did the plaintiffs file a lawsuit?

The plaintiffs sued the defendant, questioning its legal authority in categorizing Tornado Cash's immutable smart contracts as 'property' and imposing sanctions, violating the International Emergency Economic Powers Act (IEEPA) and the Administrative Procedure Act (APA).

The plaintiffs believe that these contracts are autonomously operating decentralized codes that cannot be controlled or owned, and therefore should not be subject to sanctions.

Which court made the ruling?

The United States Court of Appeals for the Fifth Circuit is equivalent to an intermediate court, which is the federal appellate court. Above it is the Supreme Court of the United States, which is at the top of the federal judicial system and is the final arbiter. Only a few cases can enter the Supreme Court through appeal or special permission (like a writ of certiorari).

What was the outcome of the court ruling?

The court ruled that the defendant (OFAC) violated the International Emergency Economic Powers Act (IEEPA) in sanctioning Tornado Cash because immutable smart contracts do not meet the definition of 'property.'

The court found that these smart contracts are decentralized, self-executing, and uncontrollable code, and should not be subject to sanctions. At the same time, the court pointed out that although technology may be abused, administrative agencies do not have the authority to expand the scope of sanctions beyond legal provisions. Ultimately, the court overturned the sanction decision and called on legislative bodies to address the legal gaps concerning emerging technologies.

Why did the plaintiffs help initiate the lawsuit against Tornado Cash?

Although these six plaintiffs are not developers of Tornado Cash, they all stated that they are users of Tornado Cash, expressing the need for Tornado Cash to enhance privacy for legitimate purposes.

For example, Tyler Almeida anonymously donated to support Ukraine through Tornado Cash, fearing that if the transaction were tracked, he might face retaliation from Russian hacker organizations. Kevin Vitale, after discovering that someone linked his cryptocurrency activity to his actual address, turned to Tornado Cash to protect his privacy. Several others made similar statements.

Immutable is a core keyword; how is it defined?

In this case, there was much discussion, definition, and summary around the term immutable, effectively recognizing the uniqueness of decentralized systems and smart contracts as new technologies. The court also acknowledged that this uniqueness of decentralized technology poses unique challenges to the current legal system.

The court's final ruling is:

Because these immutable smart contracts are not ‘property’ under the word’s common, ordinary meaning or under OFAC definitions, we hold that OFAC exceeded its statutory authority.

Because these immutable smart contracts do not constitute 'property' in either the ordinary, common sense or under OFAC's definition, we determine that OFAC exceeded its statutory authority.

She also added:

The immutable smart contracts at issue in this appeal are not property because they are not capable of being owned.

And as a result, no one can ‘exclude’ anyone from using the Tornado Cash pool smart contracts.

The immutable smart contracts involved in this case are not property because they cannot be owned.

Therefore, no one can 'exclude' others from using Tornado Cash smart contracts.

The court's definition of immutable smart contracts is:

A mutable smart contract is one which is managed by some party or group and may be changed.

An immutable smart contract, on the other hand, cannot be altered or removed from the blockchain. Importantly, a mutable contract may be altered to become immutable. But that is an irreversible step; once a smart contract becomes immutable, no one can reclaim control over it.

A mutable smart contract is one that is managed by certain individuals or groups and can be changed.

Immutable smart contracts cannot be altered or removed from the blockchain. It is important to note that mutable smart contracts can be changed to an immutable state. But this is an irreversible process; once a smart contract becomes immutable, no one can regain control over it.

But what if hackers are really using Tornado Cash for money laundering? There is currently no solution.

The North Korean hacker organization Lazarus Group stole nearly $1 billion in cryptocurrency through hacking and needed to use mixers to hide the source of funds to complete money laundering. Therefore, OFAC accused Tornado Cash's mixing feature of being used for money laundering, claiming that Lazarus Group laundered over 65% through mixers in 2021, and Tornado Cash was one of the primary tools.

Thus, Tornado Cash was accused of having indirect links to the money laundering activities of Lazarus Group and was added to the sanctions list.

The court also acknowledged that although Lazarus Group used Tornado Cash, this should not serve as a legitimate basis for sanctioning the entire protocol. Because immutable smart contracts do not belong to the traditional sense of 'property' or 'service,' the entire protocol cannot be sanctioned due to the abuse by certain users (like Lazarus Group).

Therefore, OFAC's actions exceeded the legal authority. The court urged updating the laws to address issues rather than expanding the existing sanctions framework.

The legislative time for IEEPA was 1977, long before the modern internet.

Previously, the main legal basis for OFAC's sanctions against Tornado Cash was the International Emergency Economic Powers Act (IEEPA), but the court also noted, 'The legislative time for IEEPA was in 1977, long before the invention of the modern internet.'

IEEPA grants the U.S. President the power to impose economic sanctions against foreign-related 'property' when national security, economic, or foreign policy is under 'unusual and extraordinary threat.' OFAC viewed Tornado Cash as an 'entity' and categorized its smart contracts as tools related to cybercriminal organizations like North Korea's Lazarus Group.

But the court emphasized that modifying laws to address new technological challenges is the responsibility of Congress, not the judiciary expanding legal interpretations to fill gaps. The court rejected the Treasury's attempt to expand administrative authority through judicial proceedings.

Finally

The significance of this ruling lies not only in the legality of the privacy tools behind Tornado Cash but also in clearly delineating legal boundaries for the development of the entire blockchain industry and decentralized technologies. The uniqueness of immutable smart contracts was deeply discussed in this case, and the court's ruling provides important judicial support for the legal use of similar technologies in the future.

At the same time, this also poses new challenges for regulators: how to effectively curb potential illegal uses while protecting technological innovation and privacy.

After all, this is a very appealing technology, and these two sentences in the judgment document illustrate the uniqueness of the technology well:

Simply put, regardless of OFAC’s designation of Tornado Cash, the immutable smart contracts continue operating.

Even with the sanctions in place, "those immutable smart contracts remain accessible to anyone with an internet connection."

Simply put, regardless of whether OFAC lists Tornado Cash on the sanctions list, these immutable smart contracts will continue to operate.

Even with the sanctions in effect, "these immutable smart contracts remain open to anyone with an internet connection."