Six users of Tornado Cash, a popular decentralized cryptocurrency service, filed a lawsuit on Thursday against the U.S. Treasury Department, Treasury Secretary Janet Yellen, and other officials over their decision to slap sanctions on the service in August.
The outcome of the case, which turns on the novel legal question of whether the U.S. government can impose sanctions on publicly available software code, is likely to have implications for the crypto industry for years to come.
In a 20-page complaint filed in federal court in Texas, the users claim the decision to sanction Tornado Cash exceeded the government’s authority; violated their free speech and property rights under the U.S. Constitution; and “threatens the ability of law-abiding Americans to engage freely and privately in financial transactions.”
In recent years, Tornado Cash has emerged as a popular tool for those wishing to hide their crypto transactions. Using smart contracts on the Ethereum blockchain, it allows users to deposit crypto into a pool alongside other users and then distribute it to third-party wallets; the process makes it highly difficult to determine who gave funds to a given wallet.
The plaintiffs in the case include Preston Van Loon, a prominent figure in the Ethereum community who claims he cannot access thousands of dollars worth of Ethereum deposited with Tornado Cash, and his brother, Joseph, who says he intended to use the service to privately fund an Ethereum node and staking service but can no longer do so because of the sanctions.
The plaintiffs also include Tyler Almeida, a California security analyst at Coinbase, who alleges that he used Tornado Cash to make anonymous donations to support Ukraine. Almeida claims the U.S. placing sanctions on the service impedes his right to donate—and by extension his right to express himself under the First Amendment.
Almeida is one of two Coinbase employees to put their name on the lawsuit. The company, whose CEO, Brian Armstrong, has vocally objected to the sanctions on Tornado Cash, is paying the legal bills of the employees and four other plaintiffs.
“We didn’t do this lightly. We have lots of respect for [sanctions agency] OFAC and Treasury for their work keeping us safe,” said Coinbase’s head lawyer, Paul Grewal, who added that the company believes the government overstepped its authority by placing sanctions on code.
Terrorist sanctions on software code
The decision by the Treasury Department to impose sanctions on code used by Tornado Cash has alarmed the crypto industry and the broader software development community who fear the move will stifle privacy and free expression.
The legal regime used to impose the sanctions is hardly new—it was crafted under President Barack Obama as a means to combat the increasingly sophisticated financial tools used by terrorists and rogue states to launder money and skirt sanctions.
Until now, however, the Treasury has imposed the sanctions—violations of which bring severe penalties—on people or companies. But in the Tornado Cash case, the target of the sanctions is not a specific entity but a series of smart contracts.
“The Tornado Cash privacy protocol consists of perpetually self-executing code on the Ethereum blockchain that cannot be altered, edited, or otherwise controlled,” the complaint notes.
In targeting Tornado Cash, the Treasury Department noted that the service had become a popular vehicle for North Korean hackers and others to launder proceeds of crime. In response, critics of the move say the government should have targeted individuals’ wallet addresses as they have in the past, and not the smart contracts that permit the service to operate in the first place.
According to Grewal, the sanctions decision is akin to the government going after bank robbers by banning the use of the public highway the crooks used for their escape.
In challenging the decision, Coinbase and the plaintiffs appear to believe their strongest argument turns on how to define the “persons” subject to the sanctions regime. The law in question describes “persons” as “individuals or entities”—neither of which covers something like open source software code, according to the complaint.
The Coinbase employees and Ethereum backers are not seeking damages, but rather an injunction stating that the Treasury Department exceeded its authority under the Administrative Procedure Act.
While federal lawsuits typically take many months or years to resolve, Grewal says Coinbase expects a decision fairly quickly given there is no money involved and as the case turns on a straightforward statutory and Constitutional challenge. The case was filed in the U.S. District Court for West Texas, which is known for a rapid docket compared with other federal jurisdictions.
A decision is likely to arrive in the first part of 2023 at the earliest. In the meantime, Tornado Cash users will remain without access to either the Ethereum they placed in its smart contracts or the privacy service it provides.
“None of the plaintiffs is a terrorist. None supports terrorism or state-sponsored illegal activity. None launder moneys. Each is an American who simply wants to engage in entirely lawful activity in private,” notes the complaint.
