Chainalysis│See (no) evil: privacy and compliance on-chain - Philip Gradwell│ETHDam 2024

[Music] now we have uh a name that some of you might be familiar with at least the company name chainalysis but it's an absolute pleasure to be able to invite philli to the stage because philli is someone that actually does have some philosophy over the space yeah so please welcome Phillip this is your this is your clicker and we'll do Q&A afterwards amazing and I guess I need a mic one of these ones sorry hey everybody um thanks the introduction uh I'm Phillip I'm from chainalysis which for those of you who don't know is the great Satan uh for those who take a slightly different view it's a company that provides blockchain analytics to law enforcement governments crypto businesses uh and I'm the chief Economist there and that really means I've just been there for a long time uh and done a lot of different things and today as Jonathan said I kind of want to give a bit of a you philosophical view on what the debate is between privacy and compliance bringing in that experience that I've had over the last six years I'm just going to start almost with some Basics and then go into the implications of that right blockchains are transparent means that we can see all the data they're Anonymous means that if I generate a wallet it's really hard for someone else to connect that with me but then the crucial bit that I'm going to get into is that blockchains are actually really used by Services right businesses exchanges smart contracts and they're actually not Anonymous you know we know the name of this smart contract we know the addresses this exchange uses and they have responsibilities and it's really the Confluence of these three different things that transparency that anonymity and the responsibilities of services that I think creates the real debate around privacy and compliance so that's really my question like what is the balance between these two things and I should say like I do think it's a balance uh there you can be very absolutist about this and be like privacy absolute right in all cases can debate that as well but I'm really thinking here about some of the trade-offs that people have made in reality to try and make this work so transparency and you know a little bit of a philosophical uh presentation so there's going to be a decent amount of text so sorry about that um but with transparency what it really means is that everything can be seen right all of the transactions that are made on a blockchain are on the blockchain the big issue is you have to know what to look for um and like that gets kind of hard cuz like there's now a new layer one there's a new layer two people just Bridge across this they go across that there's like loads of transactions it takes a remarkable amount of effort and human in the loop work to go and actually sift through that and understand what's important so that's the first thing about transparency yes it's all there but you've got to know where to go and look the other thing about everything being on the blockchain is it actually reduces everything to a math problem and you know that's kind of important when you have complete information it means if you've got a big enough computer and a smart enough algorithm you can kind of go work anything out it also means things like zero knowledge proofs are really important because they're also a math problem they're much harder to get information about but the problem again is that everything needs to be human understandable great you can get a computer to go work everything out but if there is a compliance situation it's pretty much always a human compliance officer or a human customer or a human court that needs to decide something and that means that what all of these arguments we can have about you know data and Technology go back into a very human process right there are people who have to make decisions and they do that based on all of their experience and ethics and so it's really important to understand how crypto actually connects into that and then the final big implication on the transparency is it it means that basically uh and Frank touched on this just before you know source and destination of funds checks basically equals compliance that is what compliance means in very practical terms on the blockchain do you know where these assets came from do you know where they're going to things like scams it can get more complicated but source and destination of funds checks is the basis of crypto compliance today and if you do want to learn more there's actually a book about this called traces in the dark which explains the Journey of blockchain analytics so just giving a little pitch for that so that's transparency what about anonymity look I spent six years in the blockchain analytics company doing quite a lot of the deep work there sometimes um and I can say the anonymity for individual wallets is actually really good like it's actually really hard to know at least by looking on the blockchain that this address is controlled by a specific individual I'll come to when that information does get revealed but fundamentally that anonymity works it's it's important though to realize that that generates a privacy of who you are and not a privacy of what you do because on the blockchain right you can see what everything is going and so you don't have that privacy of what you do but who you are that's actually pretty strong the challenge is that privacy for all of this starts to reduce when unchin activity is kind of joined with other layers of activity right so I put my uh you know wallet address on my social media handle right I join that with my ens name or I do kyc at an exchange or I don't know there's a lot of different ways in which you know the human bits of onchain data can start being joined with other layers of information and there are so many other layers of information like if you start thinking about internet privacy more generally in the web 2 world like there are data Brokers they have big databases of information they've been compiling big pictures of people for years now um so that's what I mean when they say there are other layers right and people go hey how can we actually join this onchain data with that you know that is something that happens like out in the world it's actually not something that happens in blockchain analytics um because the question is actually about how the funds flow from you know one service to another um and also partly because other people can go out there and join those data together it's not actually something that's kind of like a core speciality of watching analytics company and you'd be surprised at how important being focused on your business problem is to actually you know operating determines a lot of what you actually end up doing so anyway that's anonymity so what about Services okay um and this is potentially like a different area that people don't think about and I'm going to spend quite a bit of time like through this talking about why I think this is actually where the debate is okay so Services they're like platforms right open to send and receive crypto with a third party in exchange for good or service just a bit of a definition you're kind of building a business to do something so that's your you know your liquidity pool your exchange your merchant service even your doet market right and the key thing is that when you offer a service you are expected to know your counterparties and check their Source or destination of funds that is if you like you're licensed to operate it's why once you start doing something that has a third party involved you suddenly get these responsibilities that's often like a legal expectation it's sometimes a social expectation as well but like that exists and you can't really get around it once you start doing things on other people's behalfs and services final point there is they are typically uh where all these different layers of activity you know get joined so you know I have to give up my kyc information if I want to you know go and use a service that's kind of like a trade-off I'm making and now I make a deposit into that service and you get that end of the thread right that could then be pulled on chain and that's connected to an identity so that's kind of how that Services come into this privacy debate so that's just like a little bit of almost definition and for me that generates two very practical privacy compliance questions the first is well what if the source of destination of funds just can't be traced does that mean that we don't have a problem here and the second question is well what if compliance responsibilities do not or just cannot apply to me right because if we want to maintain privacy we're basically saying we don't really want to know where these funds are from or where they're going to we're going to give our users that privacy um so if we can't do it then that's cool we can maintain that privacy or if I'm just not responsible for knowing then I don't need to go and ask and that's why I think these are the two kind of crucial very practical like privacy questions it's what privacy sort of transforms into into questions around this andless see first spoiler alert uh source and destination funds can often be traced right it's just you can do it um you can do it on blockchains and you can do that way better than you can in Fiat systems like this is from a chain analysis crypto crime report we publish it every year and this is the destination of illicit funds and like the fact that we can produce this kind of chart you know people like Regulators don't like crypto yeah they do because you can see this um and you can understand where this list activity is going to and from and just to a point that was made earlier where the you know people tend to cash out this big blue part its exchanges it actually typically is into a small number of uh addresses typically uh into those nested services that were mentioned before you know and so we can really get into the granular detail of where these funds come from but what about mixers right they actually break that source and destination of funds in the previous chart there was a little uh bar that was the funds that came from mixers well where did those funds come from now mixers you know do break that um source and destination link right are going to some times that they don't but you know that's kind of what their business model but we can see what comes into them and we do see that quite a lot of elicit funds goes into mixers it's not the only place like I said a lot of it will go into exchanges um but people do send illicit funds into mixers then we can also see where the mixers you know send their funds afterwards and a lot of that goes into exchanges and so if you're an exchange and you're receiving this inflow from a mixer you can ask yourself do I want to have this as my counterparty given they can't tell me where these funds come from and exchanges are increasingly feeling a little bit wary about that and increasingly Regulators are saying well maybe if you're an exchange you shouldn't accept a mixer or funds coming from a mixer as a counterparty and that's a really interesting problem right cuz I'm you know trying to provide a privacy enhancing service but now people like do they have to accept me as a counterparty if I'm providing that like what forces these exchanges to be open platforms right to accept deposits from all sources do they have a right to say no if I want to enhance the privacy of my users it's a big important question the other thing about mixers is you've got to think about the Privacy set right this is where's Wally uh the game I used to play as a kid maybe it's why I ended up in crypto because I thought this type of thing is fun um and you've got to find this one character right and the you know you start on the first page of the book and it's really simple there's Wally and like two other people you found him good and then by the end of the book there's like a million people on there and it's much harder and this is just basically how in very practical terms privacy works best privacy you can have is to hide in the crowd right if you are depositing funds into a mixer and you're the only person depositing funds into a mixer you're going to be the only person withdrawing funds from a mixer or if you're the only person using Monero you're going to be the only person using Monero and you know the big question if you want to maintain privacy is well how big can I make that privacy set and that means you've got to make things you know mainstream and to do that you've got to say have funds from your privacy enhancing solution be accepted into exchanges because what do people want to do go trade on exchanges and so you do face this real trade-off right between getting lots of people in to maintain that privacy and being accepted everywhere the other thing I should say about this debate is that you know there's increasing sophistication right so literally last month or last couple of months um in the Bitcoin fog case uh was the first time that blockchain analytics was actually ADM you know cour admissible evidence before then um while law enforcement would use uh blockchain analytics software to follow the funds they would have to do what's called parallel reconstruction where they would then have to go and basically connect all the utxos without any of the labeling or tooling that blockchain analytics provides um now that has been accepted at least 15 hour I'll give the shout out to that and that's why there was a mention earlier of you know look a lot of the effort goes on to labeling and being really sure about that and actually that misses out a lot of things that are probably illicit well that's because probably doesn't count here right here you need some real certainty but that you know is an important step I kind of bring this up to say if you're thinking about breaking that link between the source and destination of funds um there's increasing sophistication is now almost allowed as Court admissible evidence to trace through that so the game has got harder and that's a really common thing in privacy right privacy is kind of in this constant battle between you know surveillance and privacy um we've seen that all throughout history and kind of there's now been an upgrade in the sophistication on the surveillance side through this court case so that's you know what if you cannot Trace between the source a destination of funds and really I'm saying like in most cases you can so now we comes the question of well what if compliance responsibilities do not or cannot apply to me I'm going to do do not first spoiler alert they do just some very simple compliance golden rules right and this is not legal advice I think I had to put that up there but really if you are setting up a crypto business you have two fundamental responsibilities on the compliance side do not allow North Korea to launder your funds and do not lose or steal your customer funds okay if you do that then you are doing pretty well on compliance in crypto and that is your minimum and like but seriously I think when people kind of go oh I don't want to set up my crypto business because there's a lot of Regulation I'm like do that and then you're probably going to be okay you can do better than that and that's nice but this is the basic responsibility so what if compliance responsibilities cannot apply to me and this I think is a fascinating question and people think they answer this question by decentralization they say I'm decentralized in my service and therefore there isn't a person who is responsible for this and there is not a good answer to this but honestly the main answer at the moment is that you are actually not decentralized or even that decentralization is not enough and like just to to be philosophical for a moment our society certainly all our rules and regulations operate on the principle that there is like a natural or legal person IE a physical person or a business that is responsible for things because few things just you know get created like Bitcoin is basically the only one maybe Jesus um for everything else there is something behind it and understanding that is a really important question so I said it's the philosophical debate um so here's a bit of text you know responsibility still exists within decentralized systems right and it's broader than just decentralization and these are just some like principles that you know I think about they're not the rules as it were but actually what is the degree of centralization is there a single entity that can control things or even change the control in the future right you know you may be like hey my system's decentralized but I've still got the private keys and I could change it in the future that's not you that's going to be a problem but it goes beyond decentralization economic interest it may be decentralized but are you making money out of it do you hold a big bunch of governance tokens and you profit from actually more and more people using this service if you do some people could argue that you have responsibility not saying you definitely do but they might come down that route third one proximity to the user so I think a good way of explaining this concept cep is um you know internet service providers are not responsible for the hate speech that goes through their servers as a packet when it's said say on Facebook but Facebook might be because they have a proximity to the user right and so this idea that there is a technology stack and as you go down that technology stack the sets of people that you deal with kind of get bigger and bigger you are going to be less responsible for What flows through your technology than if you're at the very top of that technology stack and you're only serving the set of people where the bad things happen these are just some principles but this is actually what the policy debate looks like right people go how decentralized is something actually decentralization isn't quite the right point maybe there are these other things that attach responsibility to people and because every presentation needs to end with some AI I got a serious point to make here like for me privacy is really you know this balance between privacy and compliance is actually about who is offering a service and how responsible for something are they and what we see on blockchains with you know decentralization is a genuine diffusion of responsibility and people go huh what happens when an AI starts making decisions who's responsible for that AI how the hell do I think about that well we actually have you know decentralized systems especially in Bitcoin Co and in ethereum that just operate and no one can actually really go and affect them you know there really is decentralized going on decentralization going on there and so how we think about responsibility there is going to help us think about responsibility when we have AIS going and doing a whole bunch of stuff potentially doing it on a blockchain as well just to square the confusion so just to kind of really summarize I think my argument is that the Privacy versus compliance debate really becomes pointy when we're thinking about the services okay I'm a service provider and I want to maintain the privacy of my users individual privacy on the blockchain it's like pretty good as long as you're happy with privacy of who you are not necessarily what you do um and when it comes down to hey I want to maintain the privacy of my users as a service well first of all like how happy how comfortable are you with doing Source or destination of funds checks and if you're happy with that then you're great if you're not your question is well how much responsibility do I actually want to take on on behalf of my users if I'm not doing the source or destination of funds checks for them I actually kind of become responsible for the source or destination of funds of you know of that they were choosing to use that's because I risk becoming a money launderer and if I do that if I'm going to preserve their privacy and take on that responsibility for them well am I okay with some people saying I don't want to work with you I don't want you to be my counterparty and the second question to think about is well actually how diffuse is your responsibility you know are you if you're designing a decentralized protocol are you actually designing it so that that responsibility really is not yours and are you happy with some of the consequences that come from that so hopefully this has kind of been a little bit of a journey to kind of see how we go from like these facts of a blockchain anonymity transparency the use of services into a very practical question that you might face if you are developing a service so yeah looking forward to some questions cool thank you thank you very much philli uh we can take a seat because we're also going to do a panel with you on in a minute as well um if we can change over to the slider we have some questions um the most upvoted one right now is uh the more you abide by their rules the more rules they'll have and the tighter they'll be on you what do you think about that I actually like look there's the kind of radical Vision right of going like hey these rules don't make sense and I don't you know I'm trying to build a system that exists outside of them and I think that's like actually that's you know like hey you worked at G analysis for six years is that really your view I'm like yeah and maybe when we get to the fun fact in the next round I can explain why um so like look go and be like hey I want to build a system that has a different set of rules you'll have rules in that system right but that's like the thing that you're doing if you want however to set up to make a living offering like trading of crypto then you are living in someone else's system and so if you don't go and play by those rules then actually that's when things get tighter right if you let like the way to get number one uh on the list of things Regulators are upset by is like laund money for the North Koreans and that's an example of not allowing any of the rules to apply to yourself if you do that that's actually how you get to the top of the list what's the next that's the answer you you that's the answer you're going to get um the next question is why are you going off against the US legis leg Jesus legislature and regulations uh perhaps other countries have a word to say yeah and that's a really good point um I think honestly it's like it's what I've tried to bring in here is like the Practical reality um and the Practical reality is that the US does set the standard for compliance and it largely does that through enforcement right you do something wrong and they will come after you and like it's not how the Europeans work um and Europeans eventually got there with M but like so you know yes you can have this kind of debate almost philosophically but the reality is the US has been setting the tone um and that's why there's that Focus yeah unfortunately um next question is and I think this is the first time during the entire event where someone's put a name and so it's from a North Korean perpetrator is it just North Korea that is blacklisted or perhaps Iran Venezuela Cuba Russia who to determine and create that list perhaps the haimon behind you yeah yeah and I think the so actually like back in 2018 um we were like I basically had like an internal debate in the company did like a little survey we asked people um like what basically what we found when we did this was like how what do you think of our software like what do you think of its impact in the world and the thing that people were mainly worried about was actually which countries uh had access to the software and you're like huh that is interesting like how do we handle that and like there aren't really that many good choices of like a system that you can ascribe to to say hey these are people we like and these are people that we don't like and where you end up is realizing that you know it's kind of it's a little bit binary right you're either a US aligned company or you're not a US aligned company and if you're not a US aligned company then you know you don't get to live in Amsterdam or get Capital funding um or have a very big business and so those are definitely choices that you make and they became much sharper when you get things like Russia invading Ukraine and you're like hang on we have to make like business decisions on this weird great power stuff that I thought was like something that happened in history but it's true like so you can kind of go great North Koreans are on the naughty list but should Iran what about Venezuela and I'm like I don't actually have great answers for you but I do know that there's basically a choice that you're in some sense us aligned or you're not yeah it's geopolitical it's up for lack of a better way of putting it so um just as an FYI it is officially 12:00 which means that the hackathon has closed so that is where like when you're when when you're leaving this and having lunch like please go and speak to the hackers and everything and and I I think I hope they're going to be relaxing for a little bit but just know that there's a lot of people that have just worked for a really really long time and um so I hope that you get to enjoy Also their presentations and stuff later uh so we're going to do yeah too much two more questions and then we're going to invite uh the next panel to the stage um so the next question is [Music] um Good Luck uh which checks are in place to not have one-sided expert testimony in chainalysis given its importance in course in court are there competitors also accepted um I'm like maybe not the best place person to talk about it but I'll try just because I'm not in the part of the business that does all the expert test to me um but yeah I mean other blockchain analytics providers did give uh views in those cases um and they were like considered and some of them were rejected so like anyone is free to put in their viewpoints um and that does happen uh like people submit like a bunch of evidence for this and you can like attach notes to the trial and so on and a bunch of people did I guess what we don't really see is you know like how to put it it's kind of an expert Community right everyone's kind of doing roughly the same thing um and so there aren't really people always from outside of that Community trying to go hey it's blockchain analytics the right thing to do like I'll admit like that's missing um so you know like that would be kind of a cool Civil Society thing to do and the last question I'm going to take and I of course we've got to take this one is it's funny to hear from chainalysis that they're in favor of privacy um it's the same thing as having sex in the name of virginity um so I I guess like what I want to preface with this is is the fact that I think that's exactly why it was important to have Phillip here to talk about this exact topic um that's what I'll say I mean I think like yeah I mean I don't really the thing I think that I want to emphasize is that there is this big like social process that sits behind this right it's not like you provide data you provide software you provide training but then that is taken by a group of individuals in a compliance team or in a law enforcement department and they apply a lot of their own thoughts and processes and ethics and rules and regulations to it and sometimes they do things that people don't like and sometimes they do things that people do like like recover stolen funds and you know the fascinating thing the thing why I'm still there six years later is because that like debate doesn't go right there is always that battle and like for me I say privacy is a balance with compliance and you know technology has kept raising the stakes you know we' have more and more privacy than we've ever had before if you can send encrypted messages on your phone I remember trying to send encrypted emails to people like 20 years ago it was really really hard and now I can do it like automatically and that in a sense Works in our social contracts because also surveillance has kind of got better as well and I'm really happy and comfortable being you know a part of that process and that debate cool well please give it up for Phillip [Applause] [Music]