EFF Joins Roman Storm Defense

• EFF highlights the Government's attempts to criminalize privacy and urges the court to directly apply the Fifth Circuit's sanctions reversal to dismiss the criminal prosecution of Roman Storm
• Alternatively, EFF urges the court to dismiss the case on grounds of due process, as the Government's argumentation may result in chilling effects on the development of software as an expression of free speech
• The EFF recognizes that Tornado Cash's immutable nature "is worrisome to the government," but that it is no answer "to stretch the reach of existing criminal laws beyond their breaking point" in attempts to criminalize the development of software

The Electronic Frontier Foundation (EFF), the largest and oldest digital civil liberties organization in the world, has filed an amicus brief on behalf of Tornado Cash developer Roman Storm, backing Storm's motion to reconsider the dismissal of the case.

"One of EFF’s longstanding concerns has been the careful application of criminal law to new technologies, especially as it impacts internet users, innovators, and security researchers," EFF writes in its letter to Judge Failla accompanying the filing.

"EFF has a particular concern about protecting the development of tools that advance people’s privacy and security from overbroad application of criminal laws. Although this case concerns a privacy tool for those using cryptocurrencies, the government’s prosecution raises larger civil liberties concerns that could chill the future development of privacy enhancing technologies more broadly," writes EFF.

"EFF believes that the government has stretched the criminal laws at issue here too far. If the government believes it is appropriate to criminalize these technologies, it must seek relief from Congress and not rely on IEEPA and the other laws deployed in this prosecution, or, worse, attempt to bootstrap ancillary activities even further removed from any criminal acts into the ambit of these laws," EFF continues, echoing the Fifth Circuit findings reversing sanctions on the software.

Criminalizing Privacy

"The Government seeks to base criminal liability not on the actual alleged Tornado Cash mechanism of cryptocurrency mixing [...] but instead on the broader range of technologies it calls the 'Tornado Cash service,'" EFF writes in the brief, noting the Government's fixation on the creation of the Tornado Cash web interface, the Tornado Cash User Interface (UI), as well as on what it calls "back office plumbing."

The Government's attempt to save its prosecution of Storm after the Fifth Circuits sanctions reversal now threatens an even wider array of developers and programmers, EFF argues, calling on the court to "clearly reject the implication that any tool that allows (or supports) people having 'enhanced anonymity' is inherently suspect" as "these arguments are akin to placing criminal liability on a shop because it had window blinds or a protected entryway that shields people engaging in both legal and illegal transactions."

In a previous filing, the Government argued that the Fifth Circuit's sanctions reversal had no effect on Storm's criminal prosecution, stating that "it is irrelevant in this case whether those sanctions were legally valid," precisely because the prosecution primarily rests on Storm's development of the Tornado Cash UI and adjacent services.

While the Financial Action Task Force (FATF) recommends the classification of cryptocurrency UIs as "Virtual Asset Service Providers" – a type of Money Service Business making UI developers liable to establish Know-Your-Customer and comprehensive anti-money laundering programs – the recommendation has not yet been translated into law in the US.

"Without proof of actual willfulness like criminal intent or a shared criminal purpose — neither of which appears on this record — creating a website, user interface or back-office software for a dual-use tool should not be a basis for liability," EFF argues, highlighting that the Government does not base its argumentation on the facilitation of money laundering, but on the fact that Storm developed tools which made it easier for non-technical people to use the Tornado Cash service.

"Criminal liability should not rise or fall based on whether a dual-use toolmaker shipped its product with a user manual in the hopes of making it easier to use. Digital privacy protections that safeguard lawful and important activity would be quite limited if only those with deep technical knowledge could use them," EFF argues.

Another large part of the Government's argumentation rests on the fact that Storm allegedly attempted to profit from the Tornado Cash service, framing the service's fee-based architecture as a scheme to enrich the developers with the facilitation of criminal activities.

"The government’s theories attempting to bootstrap the defendant’s role in setting up the specific function of relays and tokens used by the users of Tornado Cash," EFF argues, show just how far the Government is attempting to expand its prosecutorial reach.

The Government's arguments are "akin to claiming that Visa or MasterCard would be criminally liable based solely on receiving transaction fees whenever its customers transferred money as part of some underlying criminal activity," EFF argues, or "akin to the government claiming that it could prosecute FedEx for illegal drugs sent through FedEx from a corner store because FedEx set up and 'supports' a process for local pack and ship corner stores to let their customers ship via FedEx, with payment remitted to FedEx."

Tornado Cash's use for ordinary citizens should "not be cast aside because those same protections can also make it more difficult for the government to investigate crime."

Chilling Effects on Software Development & Free Speech

The EFF urges the court to "apply due process and the rule of lenity" to "prevent the government from relying on the creation and general support for ancillary, dual-use tools as a basis for liability."

"If adopted," EFF argues, the Government's arguments would potentially "subject software developers, especially those engaged in development of tools that can be used to provide anonymity, to uncertain legal footing with severe criminal consequences."

The EFF recognizes that Tornado Cash's immutable nature "is worrisome to the government," but that it is no answer "to stretch the reach of existing criminal laws beyond their breaking point" in attempts to criminalize the development of software.

"If Congress wishes to pass a law that is intended to reach a tool like Tornado Cash, it can do so," EFF argues, as "the legislative process allows the opportunity to carefully and clearly differentiate illegal from legal behavior, and to give developers and users clear notice when they step over that line. The prosecution’s arguments in this case do neither," EFF states, describing the statutes as applied to Storm as "ambiguous."

"The government’s theory turns basic features of technology, such as the websites, user interfaces and fees paid to conduct transactions on a blockchain, into criminal acts," writes EFF. "Under such an expansive reading of both IEEPA’s text and criminal liability more broadly, software developers would be at the mercy of the government’s vast and potentially unbounded discretion."

According to the EFF, "the government’s prosecution chills First Amendment activity by discouraging the development of privacy protective software," reminding the court that it has a responsibility to interpret vague statutes as narrowly as possible to ensure that those enforcing the law do not act in an arbitrary or discriminatory way.

Independent journalism does not finance itself. If you enjoyed this article, please consider donating to our Geyser Fund.