IBA Annual Conference Tokyo October 2014

Bitcoin, Cybercrime and Future Regulation

Monty Raphael QC Special Counsel

15 Fetter Lane, London, EC4A 1BW Tel: + 44 (0)20 7822 7777 Fax: + 44 (0)20 7822 7788 insert [email protected] www.petersandpeters.com

2

1. What is a ?

Cryptocurrencies are a subset of digital currencies that provide a medium of exchange using cryptographic protocol to verify the exchange of funds and regulate the creation of new units of currency. Hundreds of now exist however most are similar to and based on the first fully implemented crypto currency, Bitcoin1. The following are notable for their innovation:

 Namecoin, introduced April 2011, was created as an attempt at forming a decentralized DNS making internet censorship extremely difficult.  Litecoin, introduced October 2011, was the first successful cryptocurrency to use scrypt as its hash function instead of SHA-256.  Peercoin, introduced August 2012, was the first to use a proof-of-work/proof-of-stake hybrid.  Nxt, introduced late 2013, exclusively uses a proof-of-stake mechanism.

The pioneer cryptocurrency will be used as a model cryptocurrency in this paper in light of its continued market dominance.

2. What is Bitcoin?

Bitcoin is the first fully implemented decentralised peer-to-peer payment network introduced by pseudonymous software developer in 2009. It provides frictionless, worldwide payments with zero or minimal transaction fees. Bitcoin is based on open-source software enabling it to operate without the need for any central authority or bank to regulate it, instead the creation and management of is carried out collectively by the network.

Bitcoins do not generally physically exist except insofar as the number associated with a Bitcoin address has been embedded into an object. Only records of transactions between Bitcoin addresses exist, therefore to work out a user’s Bitcoin balance the information must be reconstructed by looking at the previous transaction history.

New Bitcoins are generated by the network through a process known as mining. Mining also serves to add confirmed transaction records to a vast public of previous transactions known as the block chain. Bitcoin nodes (computers running Bitcoin software and participating in the peer-to-peer network), then use the block chain to distinguish legitimate Bitcoin transactions from false ones such as attempts to double spend. Miners therefore protect the overall security and integrity of the network by reaching a consensus on the state of the network.

To create Bitcoins miners apply complex mathematical formula to a block. Blocks are regularly produced by the Bitcoin protocol comprising transaction history from a set period, the previous blocks hash and a nonce (a random piece of data). The applied formula results in a seemingly random sequence of letters and numbers known as a hash. In order to confirm a block of transactions as genuine and add them to the block chain the hash produced must fit a certain formula i.e. have a certain number of 0’s at the start. Consequently, successful creation of a hash is not as simple as applying the formula to the data, as there is no way of telling what a hash will look like prior to its creation, it will often require many attempts to create a hash that conforms to the Bitcoin protocol. Mining is therefore designed to be difficult, requiring lots of computer processing power with the difficulty of the mathematical formula applied increasing as the

1 For further details see https://bitcoin.org/

IBA Annual Conference Tokyo - October 2014 Monty Raphael QC

3

network size does. As a result mining has now become a specialised, hardware-intensive and expensive pursuit.

In return for this resource-intensive work miners receive a subsidy of new Bitcoins for every block of transactions confirmed. The amount of Bitcoins currently received by successful miners stands at 25 and will half at a set rate until the original limit of 21 million Bitcoins are mined (estimated to happen at or near the year 2140).

3. Mainstream acceptance

When Bitcoin was released it was alternatively regarded as a speculative bubble2, an innovative libertarian experiment and, “a fatally flawed idea shaped by people who don’t really understand how money works”3. As Bitcoins have no intrinsic value – they are not backed by anything, their value being solely determined by supply and demand – many doubted Bitcoins ability to ever enter the mainstream market.

Eventually the underlying technology’s benefits were widely realised, such as the potential to revolutionise the multi-billion dollar remittance market and bring traditional financial services to those without previous access in the developing world – the so-called unbanked. Faith in the underlying technology has therefore led to widespread investment in and diversification of Bitcoin businesses exemplified by Forbes singling out Bitcoin as the best investment of 2013.4

Bitcoins are now easy to access and use with Bitcoin ATMs appearing across the globe and major online retailers increasingly accepting them as payment.5 Online Bitcoin exchanges around the world also enable people to purchase Bitcoin with regular currency to engage in the market. Bitcoin use has further widened from everyday purchases to those hedging against volatile currencies in emerging markets, and with the Bank of England’s estimation of 41 million Bitcoin accounts in existence, it appears Bitcoin has now also gained critical mass in terms of users.6

4. Associated cybercrime

Bitcoin maintains an association with cybercrime due to internal security issues and its popularity with the black market. The near anonymity provided by the service, its dubious legal status and transnational existence make it an obvious, attractive opportunity for money launderers and criminals alike. However it is important to acknowledge the technology underpinning Bitcoins operation is not inherently criminal, nor are persons seeking a level of anonymity in a modern world of intrusive, universal surveillance.

Bitcoins security issues became a news item with the bankruptcy of Tokyo based Mt. Gox in February 2014. Mt. Gox was one of the largest digital currency exchangers until its computer system was hacked and approximately $477 million worth of Bitcoins were stolen prompting it to declare bankruptcy. Flexcoin, a Bitcoin storage company in Canada, also closed down in

2 Jeff Kearns, ‘Greenspan Says Bitcoin a Bubble Without Intrinsic Currency Value’, 4 December 2013; http://www.bloomberg.com/news/2013-12-04/greenspan-says-bitcoin-a-bubble-without-intrinsic-currency-value.html, accessed 15 October 2014 3 Cade Metz, ‘Meet Patrick Byrne’, 2 October 2014; http://www.wired.com/2014/02/rise-fall-rise-patrick-byrne/ accessed 10 October 2014 4 Kashmir Hill, ‘How You Should Have Spent $100 In 2013 (Hint: Bitcoin)’, 26 December 2013; http://www.forbes.com/sites/kashmirhill/2013/12/26/how-you-should-have-spent-100-in-2013-hint-bitcoin/ accessed 12 October 2014 5 For a list of online and real world businesses that currently accept Bitcoin see https://en.bitcoin.it/wiki/Trade accessed 13 October 2014 6 Robleh Ali, ‘The Economics of Digital Currencies’, Bank of England Quarterly Bulletin 2014 Q3

IBA Annual Conference Tokyo - October 2014 Monty Raphael QC

4

March 2014 following the theft of approximately $650,000 worth of Bitcoins. Such incidents continue to occur and indicate clear issues with transaction malleability and safe storage of Bitcoins, though this is often attributed to a lack of proper understanding of security requirements.

Bitcoins popularity with the black market lies partly in the difficulties of locating its pseudonymous users. The now defunct online drugs bazaar exclusively operated using Bitcoin for this very purpose. In 2012 it was estimated that 4.5% to 9% of all transactions of all Bitcoin exchanges in the world were for drug trades on Silk Road.7 Following a lengthy, international effort the FBI finally closed down Silk Road on 2 October 2013 proving that cybercriminals are not beyond the reach of law enforcement. Nonetheless, high profile cases such as Charlie Shrem, co-founder of Bit Instant, who pleaded guilty on 4 September 2014 to operating an unlicensed money transmitting business involving Bitcoins to facilitate criminal activity8, continue to maintain the association between the black market and Bitcoin.

The uncertainty surrounding Bitcoins legal status has also led to novel arguments as to whether Bitcoins can support money laundering charges at all. In the cases coming before the US courts Bitcoin criminality has been widely accommodated to ensure convictions are secured. Therefore the short answer has been a resounding yes as the existing case law in the US combines to illustrate, “Bitcoin’s controversial status isn’t going to help its owners or traders avoid prosecution for financial crimes.”9

Overall, criminal activity can be seen as an inevitable by-product of innovation, criminals will seek to benefit from the technology just as everyone else. As the Bitcoin market continues to expand its illicit associations must be actively policed but should not be exaggerated, as Ivo Opstelten, the Netherlands minister of justice, points out, “financial transactions for criminal activities are not reserved for cryptographic payment forms.”10

5. Legal Status

The legal status of Bitcoin can best be described as inconclusive with regulators across jurisdictions taking markedly different approaches to the emerging technology. What is clear is that countries are now actively considering the technology with the expectation that, “we will see over half of the world’s governments take a formal position on Bitcoin by the end of this year.”11

Responses have ranged from the outright ban in Iceland to Germany’s recognition of Bitcoin as a unit of account12 to Russian proposals making Bitcoin transactions a misdemeanor punishable by fine.13 Varied concerns such as the risk of capital flight, the ability of existing money laundering controls to adequately cater for Bitcoin and the stability of the host currency

7 Nicolas Christin, ‘Traveling the Silk Road: A Measurement Analysis of a Large Anonymous Online Marketplace’, Carnegie Mellon University CyLab Report 12-018, 30 July 2012 (revised 28 November 2012) 8 Joon Wong, ‘Charlie Shrem to Forfeit $950k to US Government in Plea Bargain’, 5 September 2014 http://www.coindesk.com/charlie-shrem-forfeit-950000-us-government-plea-bargain/ accessed 15 October 2014 9 Buckley Sandler LLP, ‘Digital Insights and Trends: Can Bitcoin Support Money Laundering Charges?’, 1 October 2014 (updated 7 October 2014); http://www.infobytesblog.com/digital-insights-and-trends-can-bitcoin-support-money-laundering- charges/#page=1 accessed 10 October 2014 10 Peter Rizzo, ‘Dutch Official Downplays Law Enforcement Need for Bitcoin Ban’, 17 March 2014; http://www.coindesk.com/dutch-official-downplays-need-for-bitcoin-ban-despite-criminal-use/ accessed 15 October 2014 11 ‘50+ Bitcoin Experts Share Their Thoughts On What The Future Holds For Bitcoin [Part One: Regulation], 23 January 2014; http://foundersgrid.com/bitcoin-regulation accessed 15 October 2014 12 Charles Arthur, ‘Bitcoin now ‘unit of account’ in Germany’, 19 August 2013; http://www.theguardian.com/technology/2013/aug/19/bitcoin-unit-of-account-germany accessed 14 October 2014 13 Pawel Kopczynski, ‘Bitcoin users in Russia to face harsh fines – draft bill’, 6 October 2014; http://rt.com/business/193624-russia-bitcoin-fines-cryptocurrency/ accessed 12 October 2014

IBA Annual Conference Tokyo - October 2014 Monty Raphael QC

5

contribute to the array of legal approaches adopted. The crux of the legal distinction in countries receptive to Bitcoin remains whether Bitcoin is to be classified as a commodity or payment method with the US heading in the former direction and EU countries in the latter.14

The US federal approach is set out in IRS Notice 2014-21 declaring Bitcoins as subject to Money Transmission, KYC and AML rules with accompanying official guidance.15 The US approach at state level is pioneered by the Department of Financial Services with their July 2014 introduction of draft proposals for a Bit Licence.16 The proposals prompted international concern of an overbearing approach with Chinese Bitcoin exchanges BTC China, OKCoin, and announcing in a joint statement that the, “proposed regulation is overly broad in its application outside the , imposes a disproportionate compliance burden on virtual currency businesses, and misapplies normal compliance procedures.”17 The discussion period has now been extended to October 21 2014 for further feedback given the final model of the New York licence being crucial with other countries likely to follow suit basing any future licence proposals from the New York model.

In contrast, the UK government’s intention to, “cement Britain’s position as the centre of global finance”18, has manifested itself in widely praised management of Bitcoin thus far. On 3 March 2014 HMRC issued new guidance effectively treating Bitcoin as a payment method but stopping short of recognising it as a currency.19 The new guidance was heralded as "some of the most sophisticated and forward-thinking issued by tax authorities anywhere in the world.”20 On 6 August 2014, Chancellor George Osborne further announced a new initiative to explore the potential role of cryptocurrencies in Britain with a Treasury report due to be published in the autumn.

6. Future Regulation

As Bitcoin enters the mainstream with prominent businesses beginning to utilise it, the stability and security provided by regulatory oversight becomes an increasing expectation. Future regulation therefore has the difficult task of securing this emerging technology for mainstream use without stymying its innovative properties or subjecting its users to disproportionate measures. It is important to remember Bitcoin is still in its infancy and the process of regulation is ongoing. The success of future regulation will in part be based on the degree of international dialogue surrounding the topic.

Inherent difficulties exist with cybercrime regulation - jurisdictional uncertainty, increasing anonymity and the fragile nature of digital evidence. However, Bitcoin brings a further new challenge in that users are operating on what is essentially an uninterruptable network with no central server or authority that can be targeted by law enforcement. The innovation brought by

14 M Mimic, Regulatory Challenges of Alternative E-currency: Comparative Analysis of Bitcoin Model in US and EU Jurisdictions, 31 March 2014 15 US Department of the Treasury, Financial Crimes Enforcement Network, ‘Application of FinCEN’s Regulations to Persons Administering, Exchanging or Using Virtual Currencies’, 18 March 2013 16 New York Department of Financial Services, ‘NY DFS Releases Proposed Bitlicense Regulatory Framework for Virtual Currency Firms’, 17 July 2014; http://www.dfs.ny.gov/about/press2014/pr1407171.html accessed 15 October 2014 17 Anthony Cuthbertson, ‘Why is Bitcoin’s Price Falling? Whales, Regulations and Wider Adoption’, 6 October 2014 http://www.ibtimes.co.uk/why-bitcoins-price-falling-whales-regulations-wider-adoption-1468642 accessed 15 October 2014 18 George Osborne MP, ‘Plan to make Britain global centre of financial innovation set out by government’, 6 August 2014; https://www.gov.uk/government/news/plan-to-make-britain-global-centre-of-financial-innovation-set-out-by-government accessed 14 October 2014 19 HMRC Brief 9, ‘Bitcoin and other cryptocurrencies’, 3 March 2014; https://www.gov.uk/government/publications/revenue- and-customs-brief-9-2014-bitcoin-and-other-cryptocurrencies accessed 10 October 2014 20 UK Digital Currency Assocation – News, 3 March 2014; https://www.ukdca.org/index.php/news/9-news/28-hmrc- issues-tax-briefing accessed 10 October 2014

IBA Annual Conference Tokyo - October 2014 Monty Raphael QC

6

the technology therefore has to be matched by those in law enforcement with the major imperative being increased technical ability; improved online identification and tracking techniques, training in the handling of digital evidence and recruitment of those at the forefront of the industry. The global nature of cybercrime further requires cooperation at an international level to implement consistent legislation and form interjurisdictional task forces capable of dealing with the evolving challenges presented by cybercrime.

6.1 Self-regulation

Bitcoin businesses generally recognise that enacting relevant self-regulation corresponding with the standards expected of traditional financial institutions will lead to faster market growth. Early attempts to self-regulate include services like the Bitcoin Identity Security Open Network (BISON)21 that collects and validates transacting customer’s personal data in accordance with KYC rules and other community based initiatives like Bitrated that provide protection from fraud through the introduction of community arbitrators policing transactions.22 Other suggestions include trial and error style experimentation assisted by private regulatory bodies like the , a non-profit organisation designed to, “standardise, protect and promote the use of Bitcoin cryptographic money for the benefit of users worldwide”.23

Self-regulation may therefore be seen as viable and favourable option whilst the technology is still developing. Allowing developmental control to be retained within the user group and also enabling governments to abstain from declarations on the legal nature of Bitcoin thereby denying it a clear legal status until its full effect can be surmised and properly subsumed within a regulatory structure.

Equally, whilst self-regulation would allow maximised innovation it would not provide the consumer protection emerging industries require from regulation. It would further fail to adequately clarify the liabilities of existing and new businesses in the Bitcoin market who currently take an expensive approach of excessive self-regulation in a bid to anticipate what liabilities will be imposed on them.

6.2 Targeted regulation

Total regulation of the is unfeasible due to its open-source, non-jurisdictional nature. It would also prove unwise given Bitcoin’s creation was in part a response to distrust of governments and traditional financial institutions. Attempts to identify the user population therefore have the potential to create further hostility resulting in greater obfuscation of illegal activities.24 Moreover, persons identified as such are not likely to be sophisticated criminals but rather novice users who leave personally identifiable information in their transaction data. Therefore in order to yield the best results and effectively harness available resources law enforcement entities will need to target specific aspects of Bitcoin transactions.

Targeting those acting with clear criminal intent may seem an obvious strategy however the overarching issues of pseudonymity and jurisdictional uncertainty dictate this would be an unproductive pursuit. Users acting with such impunity are unlikely to leave any personally identifiable information in their transaction data and invariably hide in jurisdictions with less strict international laws where US and other authorities are unable to reach them. Therefore the

21 For further details see https://www.jumio.com/bison/ 22 For further details see https://www.bitrated.com/ 23 P De Filippi, Bitcoin: A Regulatory Nightmare to a Libertarian Dream, 23 May 2014, Internet Policy Review, Vol. 3: Issue 2 24 D Bryans, Bitcoin and Money Laundering: Mining for an Effective Solution, Indiana Law Journal: Vol. 89: Issue 1, 2014

IBA Annual Conference Tokyo - October 2014 Monty Raphael QC

7

extensive resources required to locate and prosecute such users would likely be best applied elsewhere.

Regulating miners who enable criminals to use the network by confirming their transactions authenticity would also likely prove a clumsy approach. Miners are incentivised by the subsidy of new Bitcoins therefore it is unlikely many will be working with a truly criminal intent. Moreover, proving such an intention encounters further difficulties given the actual processing is done by specialised software often without any user input. Lastly, miners are also of course pseudonymous, they are not easily locatable and will require extensive resources to prosecute.

Bitcoin currency exchanges would appear to be the natural target. They are increasingly subject to AML and KYC rules and require user confidence to gain credibility and exchange large volumes. Any successful exchange undertaking large scale transactions will therefore have to be aware of their responsibilities under domestic and international law in line with those imposed on traditional financial institutions. Large exchanges operating outside these rules would therefore be doing so without reasonable excuse and form easy targets for regulators without having to dedicate excessive resources to tackling the pseudonymous nature of Bitcoin.

7. Conclusion

Overall, it is unlikely any new law will be able to sufficiently capture all available versions of this emerging technology for a prolonged period. Law enforcement must therefore primarily focus on updating its resources to effectively combat cybercrime and monitor emerging patterns of criminality in digital currencies. It is clear from ongoing consultations that regulation is coming and businesses will be better off complying with existing AML laws to their best interpretation rather than having to implement a full new set of controls in the near future.

© Monty Raphael QC.

The author would like to express his thanks to William Cholerton of Peters & Peters for his assistance in preparing this paper.

IBA Annual Conference Tokyo - October 2014 Monty Raphael QC