News
A First Amendment Fight for the Future of the Internet
Storm was right about what this meant for him and his fellow app creators. That August, the U.S. Treasury Department subjected Tornado Cash to severe sanctionsDays later, officials in the Netherlands arrested co-developer Alexey Pertsev. And a year later, the U.S. Department of Justice indicted Storm and a third developer, Roman Semenov. They are charged with money laundering, violating U.S. sanctions law and operating an unauthorized money transmitter.
In May, a Dutch court found Pertsev guilty of money laundering and sentenced him to more than five years in prison. Semenov remains at large. Storm’s trial is scheduled to begin in September in New York. He faces up to 45 years behind bars.
Federal prosecutors say Storm helped Lazarus Group launder money, though they have not presented any evidence that he provided direct assistance. Storm’s defenders, who include blockchain advocates and the Internet freedom group Electronic Frontier Foundation, say all he did was help create a software tool.
Storm’s lawyers say the First Amendment protects its actions, because for nearly three decades U.S. courts have recognized software code as protected speech. “At its core, this prosecution represents an unprecedented attempt to criminalize software development,” Storm’s lawyers argued in a March motion to dismiss the indictment.
The dispute is technically and legally complex. But at its heart is a long-standing debate over whether software code is protected by the First Amendment. And the outcome could determine whether a new class of software is truly off-limits to Americans.
“The Bad Things People Do With the Software You Write”
In 1995, mathematician Daniel Bernstein sued the U.S. State Department. He said the government had violated his First Amendment rights by requiring him to register as an arms dealer and obtain an export license before he could publish the source code for Snuffle, his encryption algorithm. A district judge agreed with Bernstein, rejecting the government’s argument that the Snuffle code was conduct, not speech.
The Ninth Circuit Court of Appeals upheld the lower court’s decision in 1999. Several other lower court decisions in the late 1990s reached the same conclusion as the Bernstein case. The justices considered code to be speech because it is written in a language and is a mode of communication: it is “expressive.”
But contrary to what many in the tech world seem to think, this legal issue is not settled. In a dissent to the Ninth Circuit’s decision in Bernstein , Judge Thomas G. Nelson made a compelling point: “The basic function of the cryptographic source code is to act as a method of controlling computers,” he wrote. “This functional aspect of the cryptographic source code contains no expression; it is simply the tool used to build the cryptographic machine.”
The code that runs Tornado Cash may be expressive, but it also works. It instructs a blockchain network to anonymize cryptocurrency transactions by using advanced cryptography to untraceably transfer cryptocurrency from one software “wallet” to another. While the cryptocurrency is in the first wallet, it is linked to every transaction the wallet has ever participated in. In the second wallet, all that history is erased.
Encryption and privacy advocates believe that encrypting transactions in this way has legitimate uses, such as anonymous donations to a sensitive political cause. But like cash, Tornado Cash has illicit uses. The Lazarus Group used it to sweep up digital breadcrumbs that allow investigators to track criminal funds on blockchains.
What makes Tornado Cash new to the law is that, despite Storm and the other developers knowing that cryptocurrency thieves were using Tornado Cash, they failed to stop the criminals. The core of the privacy tool is a set of smart contracts (a cryptographic term for software that runs on a blockchain) that no one, not even the creators of Tornado Cash, can change or shut down.
That’s the point of blockchains: they run without the control of any single entity or person. Blockchain-based software can have built-in kill switches and ways for developers to make updates, but the developers of Tornado Cash have chosen to renounce all control over the main application in 2020. They claim that their intention was to give privacy to cryptocurrency users, not to help criminals.
“The question is whether you can be held criminally liable for bad actions that people do with software that you write, even if you didn’t intend for them to do those bad actions with that software,” says Peter Van Valkenburgh, research director at the Washington, D.C.-based policy advocacy group Coin Center.
In the Netherlands, the answer appears to be yes, and Alexey Pertsev will have to spend more than five years in prison for it. The US Constitution further complicates Roman Storm’s case.
When parallels break down
The sanctions law that Storm allegedly violated is called the International Emergency Economic Powers Act (IEEPA). Passed in 1976, it gives the president the power to regulate international trade in the name of national security. In 1988, Congress amended the IEEPA to clarify that the president cannot block the international trade of items protected by the First Amendment, including books, music, art, and other “informational materials.” This update became known as the Berman Amendments.
Storm’s defense team has argued that the Tornado Cash software is informational materials under the Berman Amendments. And while that law doesn’t protect Storm, they argue that the First Amendment does.
The government responds that much of Storm’s defense rests on a simplistic idea: that “he should not be held criminally liable because his conduct involved computer software.” That idea “would have incredibly broad implications,” prosecutors wrote in an April court filing. For example, they said, it would prevent the president from barring a U.S. bank with a foreign subsidiary from doing business with a person or group sanctioned for banking software.
But the banking parallel doesn’t work, Van Valkenburgh argues. Banks have legal relationships with their customers: promises, guarantees, terms of service, etc. Such relationships are “conduct” (not expressive conduct, like flag burning), he says, and the First Amendment doesn’t prevent the government from regulating such conduct. Tornado Cash’s developers had no such relationships with their users, Van Valkenburgh says. Crucially, they never took control of any user funds. As Van Valkenburgh sees it, the developers’ only conduct, in a legal sense, was publishing software without a backdoor that would allow them to control its use once it was out in the world.
The problem with “code is word”
The complexity of the Tornado Cash case makes it difficult to parse the arguments. But ultimately it comes down to who is responsible when a new piece of software is used to break the law.
Here lies the problem with the statement that “code is speech.”
If we assume that all code is spoken, any regulation of software will be vulnerable to a First Amendment challenge. Given the role that software plays in so many of our interactions today, this is not feasible, he says. Xiangnong (George) Wangattorney at the Knight First Amendment Institute at Columbia University.
In 2021 item In the Wisconsin Law Review, Wang argued that whether code is speech is no longer the right question for lawyers, judges, and legislators to consider. “It really comes down to how it’s used,” he says. “What are the actual values at stake?” Is it an attempt to participate in democratic discourse? To disseminate useful information to the public? Or to distribute a product? There won’t always be clear answers, Wang says. But as software becomes ever more pervasive and complex, even autonomous, the public will have to decide what exactly the First Amendment should protect.
Decentralized software applications and artificial intelligence make things even less clear. But Storm’s lawyers are still betting that they can lean hard on the First Amendment.
Van Valkenburgh’s organization, Coin Center, has argued that Storm’s choice to write and publish Tornado Cash “is an expression of a powerful political and scientific point of view in and of itself.” In other words, it argues that systems like Tornado Cash should be allowed despite the government’s disdain for them.
“Some in the U.S. government might have strongly preferred that (the developers) publish their code with a secret vulnerability or ‘backdoor’ to law enforcement, or simply not publish their views at all,” Coin Center said in a statement supporting Storm. It added: “The defendants cannot and should not be held liable for simply publishing the software as they saw fit.”
Mike Orcutt is a founding editor of Glitch Projecta newsletter focused on the future of the Internet. He was previously an editor at MIT Technology Review and The Block, a cryptocurrency news publication.