# Navigating Privacy in Crypto: Current Challenges and (Future) Solutions - Vyara Savova | EUCI

- Channel: [ETH Belgrade Community](https://streameth.org/eth-belgrade-community)
- Date: 2024-10-07
- Duration: 31:22
- Topics: People & Blogs
- Watch: https://streameth.org/watch/yt-4ZCrHFx3ZrY
- YouTube: https://www.youtube.com/watch?v=4ZCrHFx3ZrY

## Transcript

[Music] thank you for having me um which one is the clicker sorry yeah yeah I saw it leaving so I was like no um thank you for being here uh it would be a bit of a change of tone in comparison to the first presentation particularly you will notice the difference of there being practically no AI generated images in here but instead there will be just walls of text uh which is a way for for I think the gradual uh transition to the legal topics to happen because as lawyers we love our words um but yeah as you can see that's uh privacy is the main topic and there have been a lot of interesting things developments happening in the EU but in gener generally but also in the EU around privacy um so I also uh spend some time on um the recent verdict uh from um related to the tornado cache um case so that might be interesting from a more practical perspective so that you all know basically what's what the court thinks uh but first of all just a quick present presentation a few words about the European crypto initiative we are an advocacy organization based in Brussels so what we do is we try to make the industry um happen still work even when there will be more regulation um and just just more rules around that so one of the topics that we are very very much involved with is privacy and basically the protection of our data on chain and how that would be then aligned with what's happening in the EU particularly the gdpr and similar laws um about me so I'm VI I'm a human rights lawyer I've been working quite a lot on uh topics such as privacy um I've been actively involved in the web tree space since 2018 more or less and currently I'm doing a PhD on this topic so it's really you can you can say that I'm really involved in the topic of privacy on chain and I'm um a senior policy lead with the UCI so what we'll cover basically there's going to be a short overview of the challenges but I think most of you that are here probably already have an idea that there are challenges between crypto and uh privacy and as promised um I will provide you with an overview of Alexa's case and some I would say practical things that you can take out of that and Implement in your work and then we can discuss the possible solutions that basically it would be the techys around us that would be coming up with them I can uh help with like the legal framework um on how that will happen and of course we can then discuss so here is the promised wo of text um I don't know how many of you were yesterday at Le's uh lecture but he also um when discussing privacy he was also discussing yes there are some issues obviously around privacy on chain so here I am basically providing another source of that information um in particular the European Parliament that as you can see that's in 2019 that's one year after the adoption of uh the gdpr so they started thinking okay maybe it's not really working out um so they commissioned this study and the study um pointed out these three main um issues between privacy and gdpr in particular and do and it's the immutability and the right of Erasure B basically you have probably heard about the right to be forgotten that is now enshrined within the gdpr and it cannot happen on chain it's just not how it works uh also we have the data minimization with the general rule being uh you only need to collect and use the specific amount of data you need in order to execute this specific task um which also isn't how necessarily blockchain Works uh because you already have pretty much all the data all there and you cannot just kind of usually choose a specific part to to use in a specific circumstance and of course the identification which um it's not that much about how do we identify people people that might be anonymous as I will explain on the next slide but it's more about determining who would be the controller because the gdpr has this um distinction between controller and processor of data with the controller having the responsibility of everything that happens with the data and basically you need to be able to pinpoint that specific person and when you have this chain of people um notes um it's not that easy so something that um I will go back to the left teris talk again and I hope you have been there yesterday but there was this question uh from the audience after the talk um basically what is the difference between privacy and anonymity and uh here from the gdpr point of view it's pretty straightforward because you don't need anonymity in order to have privacy basically what's interesting is that actually the Privacy regulations like the gdpr um doesn't apply to any data that is anonymous anonymized which is great news um but here is the issue that basically all the data that the industry is using all the data that is on chain wouldn't wouldn't be considered Anonymous but instead Pon nimous uh because there is this rule according to the gdpr saying that whenever there are tools like such as encryption used to in order to um the basically not the list but to uh move apart from the information about the specific person in this case we have um AB sodomized data that can in certain cases still be related to the data subject in the words of the law but basically relate to any person about whom this data is applicable so in in a sense um privacy laws apply directly to onchain activities because the data onchain isn't anonymous because the usually because the tools that we are using actually still makes it possible for that data to be directly connected to a specific person and as you can see in the points below it's just a doc thing that's necessary for this to happen basically even if you are Anonymous for a while it's always a possibility that uh all the connections between all your transactions um can be made because one of the transaction actually um doxes you and that brings a lot of privacy risks uh so um this is the reason why also the community is thinking about Solutions how do we solve that so one of the solutions that really was quite popular um was tornado cache basically uh using a mixer in general was considered as one one of the solutions however um there are issues around that um as you probably have all followed um one of the leading developers um was arrested by the Dutch uh he was held in custody for quite some time and a few weeks ago actually the court um came out with the verdict saying that he's guilty and he will serve more than 5 years in ja because of that so now I have prepared a few slides where I will go through the detail so that basically you will understand better what the cour is saying and we can then discuss basically what we think I think we kind of share the same opinion about um the general um concept of that but it would still be interesting to discuss so um basically this is the overview and what uh what the court kind of wants us to to uh really understand is uh that you don't have to read off that I can circulate it later on basically the cour is saying yes this is a tool that was created with the sole purpose of laundering money and here is where basically the issue comes because no that's not the sole purpose the purpose is to actually for us as scrypto users to have anonymity but that's a different topic um and yeah they're saying yeah it's like normal that criminals abuse that because that's the purpose basically um so I'll walk you through um I don't think it's going to be as interesting as a procedural procedural series on TV um but usually when there is a court case like criminal court case you have the prosecution on one end that's the state that is bringing up the like um the crime claiming the claims about the crimes and um kind of putting a list of evidence that it truly happened and then there is the defense site um so the defendant and the defense lawyer usually there are probably a group of people in that and but that's how it usually works and of course you have the judge that it's sole purpose is to determine who is right and who is wrong and who is guil and who isn't in this case so um the public prosecution when bringing up this case in front of the court were saying the following um claiming uh that by developing offering and improving this is a pretty important part too the tornado cach service they concealed or disguised where the crime related at mentioned in the indictment went where they came from and who was the owner of the erer at the time of the deposit and collection to which the defense basically responded uh the intention of tornado cach developers was never to break the law or facilitate criminal activity and here I will just bring your attention to the um word intention because when it comes to criminal law criminal cases the world intent and intention always comes up um because that's part of it basic Bally proving intention is very often part of proving that crime even occurred uh but intention is also a spectrum so you don't have just one pure intention I want to do it but instead there are different categories so you'll see how that matters in just a brief few slides um so int intentionally and then they um add tornado cach is therefore a privacy tool that TS to meet a legitimate need what we discussed basically it is up to the user not to misuse this software for illegal purposes bringing of course uh the oldest comparison is it's not about having like producing a knife it's about how you use the knife as we know and they add that the technical properties of tornado cach make effective action against abuse impossible basically bringing forward the argument that it's Cod it's how Cod works you cannot stop it however the court start like what the court usually does is they go through all the arguments and they're saying yeah that's true no that's not true um by using legal arguments usually if it's good court so they're saying the following um on the can ether even be laundered question they're saying well there's this coret case about Bitcoin so we kind of feel that it's the same um because here it's important what would fall under the objects category so basically they're saying yeah just like Bitcoin e are cryptocurrencies digital monetary units that represent real value in economic transactions that are subject to human control and that are transferable so basically saying yeah you can obviously launder um this type of asset and then there is the second argument also by the defense uh saying yeah but how can he launder something that he cannot have access to so the court is saying well as a matter of fact you can um saying that the leg uh legislative history again that's some old court cases and the law also shows that it is not required that a suspect has the object of money laundering in his possession or under his control adding that under certain circumstances someone can be guilty of this who does not actually have the object in question under his or her control saying practically yeah it doesn't matter you can still laer it even if it's someone else's um in someone else's possession so um then the court want went even deeper analyzing okay how how do we actually um prove that was this um direct involvement by um the tornado cach and the tornado cach quote unquote team so the defense um is saying again well it's not like a criminal operation it's actually only um the users of tornado cash that can be uh found guilty of money laundering because of the end of the dates those specific subsection of uh users that were Laing money that are the money launders but the court does not agree saying well tornado cach makes it possible to make completely Anonymous deposits into withdrawals from the tornado cash it also hides already this guyses who has the actual power of disposal over the cryptocurrency or in other words who has the cryptocurrency at hand so then it based on that it makes um The Following um argument that tornado cach cannot be seen merely as a tool for the user so this is where basically the defense argument uh according to the court uh falls short um the fact that tornado cash does not at any time have control over the cryptocurrency resulting from crime when carrying out the concealed or disguised money laundering acts does not alter this so this is pretty important and um it's fair to say that it's going to be important for other similar cases as well unfortunately and even more uh here that might be even more interesting for developers as well because they're citing the use of GitHub and one can fairly say that similar repositories as an indication for this connection and for the intent of committing this crime uh so they're saying yeah and they also put this GitHub page um and also analyzing who were um adding the most information who are the uh biggest contributors we also see that Alexi was among the top three so here you can see this direct connection um according to the court between um Alexi and what is happening and even more so they're pointing out had he actually built some of the most important functionality on there so you have the uh source code for the uh pools the UI and the relayer software that directly uh come for from him so this is basically enough for the court and here it's Al not just Alexi but there are two c suspects um so they're saying that yeah all those people um as the founders um they basically also um behaved as basically the board of tornado cach and here you can see this traditional connection because oh it operates so obviously it needs to be a company uh and have a board so the court is trying to kind of use this um way of thinking this box okay so who is in control of this company so uh according to the court they indeed acted like a board of directors of the company and they even presented that and that's pretty important up to the media basically they spoke uh representing tornado cash to Media Outlets this is kind of connected also to their imagees leading voices in this um company and again mentioning company um it's uh they also the court also mentions how they continuously developed the tool so here it's also about um the rolling out in uh phases and making available of of the two and different uh additions this one is very um I think crucial so nowhere in the verdict uh it is being mentioned as yeah we are actually arguing against the CODIS law argument but it's pretty obvious basically cor is also mentioning that the fact that it's autonomous unchanged and Unstoppable um and that's the nature of smart contract it does not exate um the criminal basically doesn't remove the guilt of the perpetrator in this case after all that is no coincidence and that's pretty interesting basically the cour is saying it's no coincidence that this person chose to use a technology like that that is irreversible in its nature so it won't be very realistic for this person to claim that oh no I I now cannot stop it so basically that's the opinion of the code of the court and continuing with like the more try uh point of view uh it says yeah tornado cash works as designed and the suspect can therefore be regarded as the perpetrator of the money laundering acts carried out by tornado cash and here you have this who is running the company what did the companies to do so yeah obviously the person that uh provided that would be responsible according to the court but it's very interesting basically saying Yeah the code is low but you are the one choosing to use this specific code um as an argument and this one as well um because we are all kind of um looking at the concept of progressive decentralization as a Way Forward uh including myself that's I think really uh what what the steps are uh but here the court is saying okay you created a dow you created the centralized autonomous organization but that doesn't change anything um so there the specific are very important of course but they're saying okay so you're were a bit too late in doing that because when you actually made that change um the most crucial parts of the code were already out there and the decisions were made so basically you created the Dow but you couldn't reverse the decisions made previously that were the problematic decisions so that's a and b basically they're saying okay you created a d but you um distributed the governance tokens in such a way that it still M ensures that the people that are the board of directors of this company have full control and they're saying yeah they are um like they have all 30% of all the torrent tokens in distribution so basically saying that's not really decentralization in a way which is also interesting now that we also have to think about how to interpret MAA and what is the centralization unfortunately this cour case might be useful in that regard in interpreting what um might be decided in these situations um so yeah it's about control in this case and again coming back to intent uh because this is criminal law of course we will have to also prove that uh if we are a court um so first the cor is talking about the connection through the interest and again it's bringing up this new token uh governance token uh that was issued and basically saying yet Toren actually incentivized further Alexi to uh go on and build this criminal tool um because now there was direct way of monetization of the usage so that's a that's the kind of intent plus um interest interest in the outcome basically of the crime and then we have the um argument by the court that um the suspect had at least a conditional intent here we are coming back to like the spectrum of intent uh so conditionally is somewhere like here and the fool I want to murder someone is here uh but still it's intent um to launder The Ether um mention in the indictment so in the indictment they are uh they have listed if you read the whole thing which probably you shouldn't but um they list they have listed all the um hacks not all but some of the major hacks basically that um occurred and that were later um the amounts of it went through uh tornado cach so the cor is further saying the suspect participated in various chat groups in which the content of the AR about the the hacks uh was discussed and the fact that cryptocurrencies with a Criminal origion were deposited in tornado cash so basically he knew or should have known based on that information and he did nothing that's what the court is saying um so yeah tornado in other words he was aware of the significant chance of that happening and here yeah what is said is that if he didn't want it to happen happen he should have stopped that which again brings us to the point that they don't really understand this do they um further on that may be also interesting from a practical point of view but tornado cash tried um to solve this in a sense by integrating a compliance tool I think with chain analysis um but basically what the cour is saying that okay this is good in a way but that's not enough because it didn't stop um the transactions that were the problematic ones and the perpetrators that were the problematic ones from using the tool because they could have just skipped this par so it was only useful for the people whose transactions were actually okay um so basically what the court um makes uh as an argument is that the development of the compliance tool does not show that the suspect did not accept money laundering by tornado cash but instead the compans to is useful for the user with legitimate in intentions but it does not impose any restrictions of the user with illegal intentions so it's basically they're saying that's not enough um and something else that I think a lot of projects are currently doing is um um they go to lawyers and they ask for legal opinions which legal opinions some of the cases are saying actually your type of work uh does not fall under this description of a regulated service so you probably don't need this license or you don't need to oblig by this uh law so uh that's what um tornado cash developers did and they received a apparently um an advice an opinion saying that actually um you don't fall under the fin and as the American um basically regulation uh so there's not any obligation to incorporate compliance measures to which the court is saying something very interesting basically saying it doesn't matter it's saying however whether or not tornado cash is financial institution which is um apparently what they ask about um and what they uh received in the opinion um that must adhere to compliance regulation is not important but instead the important question is whether the suspect and his associates complied with the law adhering to compliance rules helps prevent violations of the law but not being subject to compliance rules does not absolve from the obligations to comply with the law this is is very Catch 22 I think um as you can see because basically whatever you do you can be wrong um but what they're saying is that even though you have received this opinion um that you might not be um under this regulation it might not um have any impact um so yeah and this is the most important part I went through it so for the newcomers uh here is the um overview basically of the Alexa's court case um so basically the court is saying this is a tool for Crime uh and this all of those things that they used as arguments um prove that and what is interesting is we did some analysis um and talked to some people and basically there are some countries that also the lawyers from there are saying yes our system would have said the exact same thing so for example in France um going through like all the details that we have under the Dutch case lawyers are pretty certain that yes this is what could have happened there as well so uh the next wave basically of similar C cour cases might uh be in the making unfortunately and yeah they're not saying the knowledge plus them not doing anything to assist uh is enough for this um uh argument to be made that this inde indeed would be tried in the same way and that what they did was too little too late so I promised that we would also talk about Solutions um so they they should come from people like creating them that's um what I can be useful for is saying that some things might not work and sometime some things might work uh something that I saw that's more related to the decentralized front end topic and I'm not against this project I think it's pretty dope uh but I'm more against the the way uh it's uh being communicated so in any case whenever you're doing a useful tool don't frame it as something going against a regulation because that might backfire at some point even though obviously that's the point um so what are the solutions would that be one of them that's the Privacy pools concept by uh vitalic um why not it's yet to come also the gdpr is uh going to have a facelift probably um in the in the next few months a year so we are also as as the European crypto initiative are quite involved in those discussions and yeah with that thank you I don't know if there's time for questions but yeah [Applause] uh in euci are you mostly following the court cases or are you having like a list of most regulated coins or something like that so yeah great question um we have recently started following the court cases because there weren't any previously because that's just developing now so now we're also responding to those uh but what we do is we discuss the regulation when it's in its infancy in front of the European commission the Parliament and the council so uh we started as a reaction to the m marketing crypto assets regulation we were like no uh the industry needs to have a say in this so that's when we uh gathered as an organization and started responding and basically helping the regulator also understand what is necessary not to destroy this um industry uh so we are just dealing with the problems as they come M uh we have also the amlr anti-money laundering regulation that is completely not fit for uh for crypto we also have obviously privacy but uh other topics as well as infrastructure front ends so forth uh so yeah we are kind of developing as the need and the industry is also developing we started as an advocacy organization but now we're also shifting in watching this type of things happening thank you so much thank you very much