Evidence submitted by Professor Ross Anderson (DGC0047)

Failures of Trust and Regulation in Cryptocurrency

Submission to the Digital Currencies Inquiry of the Treasury Committee

1. I am Professor of Security Engineering at Cambridge, a Fellow of the Royal Society and the Royal Academy of Engineering, and have years of experience in fintech and payments generally. Among other things I was a designer of Android Pay and of the STS specification for prepayment utility meters, with 400 million in use worldwide.
2. This submission has been prepared with the help of Ilia Shumailov, Mansoor Ahmed, Johann Bezuidenhoudt and Nicholas Bohm.
3. Cryptocurrency has brought some interesting innovation but many unacceptable side-effects. About a tenth of all bitcoin have been stolen at least once; a third of cryptocurrency exchanges have gone bust, thanks to external hackers or crooked insiders; and bitcoin mining now emits as much CO2 as Ireland.  This has led governments to consider what regulation might be necessary and proportionate.
4. Following a US lead in 2013, most countries now require bitcoin exchanges to register as money service businesses. Since 2017 there has been enforcement action against rogue operators and many governments now insist on FinCEN registration.
5. One outstanding problem has been tracing stolen bitcoin. All bitcoin transactions are recorded on a public blockchain, so when a bitcoin theft is reported, the courts might in theory just order exchanges to seize stolen coins. Why does this not happen?
6. Until this year many people thought that tracing was impractical technically. Cryptocurrencies are often split into smaller amounts in change, and then combined once more into larger sums, just like real money. When this happens repeatedly, how can one assign liability for stolen funds?
7. Previously, people working on tracing assumed that if I open a new wallet and pay into it three stolen bitcoin followed by seven that are freshly mined, the output is ten bitcoins that are 30% stolen (this is called ‘haircut tainting’ as the value of each recipient’s bitcoin takes a haircut, as in debt rescheduling). But the taint then diffuses but dilutes at the same time, so that eventually most bitcoins are marked as about 5–10% stolen. This is not very helpful for making crime victims good, or for holding dishonest players to account.
8. However, some relevant law in the UK and in many Commonwealth countries was established in 1816 by Clayton’s case [1], where a bank went bust and the High Court had to sort out who had a claim on which assets. The rule established then by the Master of the Rolls was ‘first-in, first-out’, or FIFO. The money first paid into an account is deemed to have been used for the first payments out of it. In our example, only the first three bitcoin spent from the wallet should be marked as stolen, and the rest completely untainted.
9. Colleagues and I wrote software to implement FIFO tracking on the blockchain, and found that the rule from Clayton’s case makes it very much simpler to track stolen funds. For example, the 2014 Flexcoin hack (where `the world's first bitcoin bank' closed after all their coins were stolen) resulted in only 18,208 tainted accounts by 2016 using FIFO, against 1,429,794 using haircut -- a reduction of almost two orders of magnitude. When we use 132 well-publicised bitcoin heists since 2011 as the input, over 75% of all bitcoin accounts with a non-zero balance are tainted by a haircut approach, while using FIFO the taint affects less than 28% of accounts.
10. Another reason FIFO tainting works better is that it does not lose information and is therefore reversible. A simple program can trace stolen funds forward from an illicit transaction; another can track backwards from a sum found on a suspect. The haircut taint can only be run forwards.
11. So what are the consequences of effective tracing? We have written both technical [2] and policy [3] papers; here we summarise the policy issues for the committee.
12. A simple analysis is that unless bitcoin are held to be money, then stolen bitcoin stay stolen. The legal principle ‘Nemo dat quod non habet’ – that you can’t give away what isn’t yours – applies in most countries. Where bitcoin stolen from Mt. Gox in 2014 are identified in assets offered to a regulated exchange, they should be seized and returned to the Mt. Gox liquidators.
13. Because of the multiple conflicts of interest between the various stakeholders, we announced when we went public with our innovation that we would make our software public, and with it a list of stolen coins, which we call the ‘taintchain’. This would put holders of stolen assets on notice and make ‘good faith’ defences harder.
14. Since then we have been approached by theft victims and have started to study the practicalities. We learn that the bitcoin world is not as it seems in theory.
15. In theory, Alice pays Bob by signing a payment order to him that references an unspent transaction output (UTXO) in her favour on the blockchain. Such a transaction appears to be peer-to-peer with no intermediation.
16. In practice, Alice goes to a bitcoin exchange and pays it (say) $1000. The exchange gives her (say) BTC 0.11 and displays this balance as being available to her to spend. However, this does not mean that the exchange creates a new wallet for Alice and transfers BTC 0.11 to it. For reasons of security, convenience, speed and minimising transaction fees, the exchange simply makes a balance BTC 0.11 available to Alice.
17. If Alice now orders a payment of BTC 0.05 to Bob, then the exchange looks to see whether Bob is also a customer. If so, then the transfer is just a ledger entry; the balance seen by Alice reduces to BTC 0.06 while Bob’s increases by BTC 0.05. This is known in the trade as an “off-blockchain transaction.”
18. In effect, crypto-currencies are morphing into an unregulated shadow banking system.
19. There is widespread doubt about whether banking regulations apply, and they are certainly not being enforced. 
20. At the very least, the FCA and the Bank of England should require exchanges to comply with the E-money Regulations (and the underlying Directive), according to which “electronic money” means electronically stored monetary value as represented by a claim on the electronic money issuer which—
1. is issued on receipt of funds for the purpose of making payment transactions;
2. is accepted by a person other than the electronic money issuer; and
3. is not excluded by regulation
21. This regulation seeks to ensure, inter alia, that an exchange does not credit customers with more bitcoin (or other assets) than it actually has. The rate at which exchanges have gone bust shows that the risk is real.
22. Clarity is also needed on ownership. The theft victims to whom we have talked are not clear whether, when they bought bitcoin, the exchange ended up owing them a certain quantity of bitcoin from its pooled stock (in the same way that the customer of a bank who has a credit balance is simply owed money by it) or whether the exchange had sold it some bitcoin of which it was now the custodian (as might be the case with a wine investment company).
23. The exchange contracts we have looked at do not make this clear. A customer may always have a sum of cryptocurrency sent to his offline private wallet, just as a bank customer can withdraw cash or a wine investor can collect his bottles, but in practice most exchange customers do not do this.
24. As a result, helping crime victims who have asked us for assistance in tracking and recovering their stolen bitcoins is problematic. It is often not at all clear whether the victim’s claim is against the exchange of which he or she was a customer, or against the exchange where the stolen coins have now ended up. The exchanges have no incentive to help crime victims; if they were to make clear that they are like banks rather than like wine merchants, then customers who are victims of fraud might sue them to get their money back.
25. Curiously, bitcoin advocates have argued for some years that governments should intervene to make bitcoin fungible, perhaps by declaring them to be money so that a holder who acquired bitcoin in good faith in the ordinary course of business would get good title. Governments have declined to do that, leaving uncertainty by treating cryptocurrency as a commodity for some purposes (e.g. capital gains tax) and as foreign money for others (in the UK, for VAT). The industry seems to have tackled the fungibility issue by making the very ownership of bitcoin obscure.
26. In conclusion, consumer protection has failed.  Either the existing regulations should be reformed and applied or new ones should be devised.
27. Intermediation must oblige the intermediator to guarantee that an asset they hold for a customer, or to back an obligation to a customer, is of good value and not tainted. 
28. We first recommend that a key aspect of consumer protection and criminal asset forfeiture should be the application to blockchains of the FIFO rule from Clayton's case. To facilitate this, regulators should make clear that bitcoins do not enjoy the exemptions to the nemo dat rule that apply to normal money and to bills of exchange.
29. Second, regulators should also require that a regulated bitcoin exchange that finds itself in possession of stolen cryptocurrency must not just sell it on, but instead return it to its rightful owner.
30. Third, regulators should tackle the doubt over who actually owns which bitcoin. They should compel registered bitcoin exchanges to make clear in their contracts whether they are like banks or like wine merchants. Do they own the bitcoin in wallets they host, or do customers?
31. In the former case the exchanges must make fraud victims good unless the customer was complicit or grossly negligent. Regulators should also apply the provisions of Payment Services Directive 2 to regulated exchanges, including the requirement for a low-cost dispute resolution service, and consider whether this should be the Financial Ombudsman Service.
32. Fourth, the authorities should apply anti-money-laundering rules to cryptocurrency operators, exchanges and other service providers who deliberately mix up criminal and other funds in order to make tracing harder. Regulators and law-enforcement agencies should track and seize the proceeds, and prosecute such operators for money laundering or obstruction of justice.
33. Fifth, cryptocurrency exchanges operating off-blockchain must be regulated in such activities. Both the assertion ‘I bought X and therefore you guarantee that I have a claim on X of the cryptocurrency that you hold’ and the assertion ‘I bought X and therefore you are my custodian for it’ are outside the blockchain’s trust mechanism.  Traditional financial regulatory oversight is necessary to ensure the link between deposit and asset. The relevant law is the E-Money Directive 2009/110/EC, and its UK transposition the E-Money Regulations.
34. We note that the leading UK exchange, Coinbase UK Limited, got an e-money license last month and describes its services as “e-money” in its user agreement, yet this appears to refer to conventional currency accounts that are used to buy cryptocurrencies and receive the proceeds from selling them. The terms say that their digital currency services are not regulated by the FCA. We understand from the Payment Services Regulator that she does not regulate cryptocurrencies as e-money in terms of the Regulations because the FCA has not asked her to. Such subtleties are not entirely obvious to the uninformed reader.
35. Our sixth recommendation is that regulators should order registered exchanges not just to restrict their business dealings to individual customers for whom they have done proper due diligence, but also to restrict their counterparty dealings to other registered exchanges. There are large net flows of cryptocurrency between registered bitcoin exchanges operating in the USA, the EU and elsewhere, and unregistered exchanges with no declared geographical addresses – many of which are believed to operate in Russia. For example, North Korea was accused by the US government of responsibility for the Wannacry ransomware, and the ransoms it collected are said to have been laundered through HitBTC. Regulated exchanges should not do business with anonymous entities that deal with sanctioned nations or individuals.
36. Further attention needs to be paid to the question of whether some cryptocurrencies count as securities, and whether ICOs amount to offences under securities law. If exchanges or cryptocoin issers are not taking unlicensed deposits and not selling identifiable coins which they hold in custody for the customer, but rather selling an interest in a pool of assets, then they are selling a security and the relevant law should apply. I refer the committee to remarks by ex-CFTC chair Gary Gensler [4].
37. In conclusion, existing law can be used to clean up the cryptocurrency jungle. The operators in this jungle have got away with pretending to be neither plant nor animal. It is time to call their bluff. Given the way exchanges operate, the appropriate path in our view is the E-Money Regulations and then the Payment Services Regulations.

Ross Anderson FRS FREng

Professor of Security Engineering

University of Cambridge Computer Laboratory

April 2018

[1] Devaynes v Noble, 35 ER 767, 781 (1816)

[2] ‘Making Bitcoin Legal’, R Anderson, I Shumailov, M Ahmed, SPW 2018

[3] ‘Bitcoin Redux’, R Anderson, I Shumailov, A Rietmann, M Ahmed, WEIS 2018

[4] ‘Everything Ex-CFTC Chair Gary Gensler Said About Cryptos Being Securities’, Coindesk, Apr 24 2018 https://www.coindesk.com/ex-cftc-chair-gary-gensler-on-tokens-securities-and-the-sec/