Cybersecurity Policy Report, 5th Cir.: Self-executing Tornado Cash code uploaded to Ethereum blockchain was not IEEPA 'property' or 'service', (Dec 2, 2024)

By Justin Marcus Smith, J.D.

The court held the IEEPA and OFAC’s own regulatory definitions did not give OFAC the authority to block certain immutable smart contracts that could be used to launder money.

Certain immutable smart contracts were beyond the scope of the Treasury Department’s Office of Foreign Assets Control (OFAC) blocking power, held the United States Court of Appeals for the Fifth Circuit, in reversing and remanding a summary judgment decision of the federal district court for the Western District of Texas. Even if Chevron had not been overruled, OFAC’s own regulatory definition required that property be ownable, but the contracts in question here were not even contracts, and once uploaded to the Ethereum blockchain, they were beyond the control of their coder-creators. The right to exclude, one of the most important “sticks” in the bundle or property rights, was therefore absent here. The Fifth Circuit said it recognized the “real-world downsides of certain uncontrollable technology falling outside of OFAC’s sanctioning authority.” However, the court declined to “tinker” with the International Emergency Economic Powers Act (IEEPA) because it concluded it is the job of Congress to fix any “blind spots” in legislation (Van Loon v. Dept. of the Treasury, No. 23-50669 (5th Cir. Nov. 26, 2024)).

Background. In late 2022, the Treasury Department’s Office of Foreign Assets Control (OFAC) sanctioned Tornado Cash, a decentralized, open-source software project, on the ground that it allegedly facilitates anonymous money laundering transactions by the North Korea -linked “Lazarus” hacking group and others.

At issue here were at least twenty “immutable smart contracts” that provided increased transactional anonymity by collecting, pooling, and shuffling the cryptocurrencies deposited by many users. Once Tornado Cash contributor-developers uploaded these “immutable smart contracts” to the Ethereum blockchain, they became self-executing. They could no longer be altered, removed, or controlled.

Ethereum blockchain users sued the Treasury Department, OFAC, Janet Yellen as Secretary of the Treasury, and Andrea Gacki as Director of OFAC, over OFAC placement of Tornado Cash on the Specially Designated Nationals and Blocked Persons List. The Etherium users’ complaint alleged that the OFAC designation was an “unprecedented, overbroad action [that] exceeds Defendants’ statutory authority, infringes on Plaintiffs’ constitutional rights, and threatens the ability of law-abiding Americans to engage freely and privately in financial transactions” (see Banking and Finance Law Daily, Sept. 9, 2022).

The U.S. district court for the Western District of Texas (Austin) granted summary judgment for the government, noting: “OFAC’s designation of Tornado Cash does not exceed its statutory powers and is not plainly inconsistent with its regulations” (see Banking and Finance Law Daily, Aug. 21, 2023). The district court also rejected the Ethereum users’ First Amendment argument that the designation stopped them from using Tornado Cash software to make donations to political or social causes.

The Ethereum users appealed to the U.S. Court of Appeals for the Fifth Circuit (see Banking and Finance Law Daily, Mar. 15, 2024). The Ethereum users focused their appeal on the OFAC designation having violated the Administrative Procedure Act (APA) because: 1) the government did not designate a foreign national or person; 2) the immutable smart contracts were not “property;” and, 3) Tornado Cash could not have a property interest in the immutable smart contracts.

The government agencies countered that OFAC reasonably blocked Tornado Cash smart contract transactions given alleged Tornado Cash support for North Korea and malicious cybercriminals. They cited agency authority to block “any property in which any foreign country or a national thereof has any interest” and found Tornado Cash to be an entity under relevant laws.

Applying de novo review to the district court’s summary judgment decision, the Fifth Circuit held that Tornado Cash “immutable smart contracts” (i.e., lines of code) are not the “property” of a foreign national or entity. Accordingly, OFAC could not block them under the International Emergency Economic Powers Act (IEEPA), and, in doing so, OFAC overstepped its congressionally defined authority.

No deference. First, the court agreed with appellant Van Loon that, in the wake of Loper Bright v. Raimondo overruling the Chevron doctrine, the district court erred in giving “heightened deference” to OFAC’s definition of “property” and in finding that the immutable smart contracts met that definition. See Loper Bright v. Raimondo, 144 S. Ct. 2244 (2024). The Fifth Circuit’s holding on this point was dispositive.

The court reasoned that the IEEPA text only gave the President authority to block any “property” interest of a foreign country or national. The IEEPA did not define property, so the Fifth Circuit applied its plain meaning of something capable of being owned. The Fifth Circuit reasoned that the immutable smart contracts at issue in this appeal were not property because they were not capable of being owned. The right to exclude was lacking in particular. The OFAC designation of Tornado Cash did not stop the smart contracts from operating. They remained accessible to anyone with an internet connection. Nor did the designation stop peer-to-peer transfer to users, even without their knowledge or consent. The IEEPA plain meaning of “property” did not support the OFAC designation, despite the OFAC’s longstanding regulatory definition of “any property,” including “contracts of any nature” or “services of any nature. Even without regard to Loper, the immutable smart contracts still had to be “ownable” under OFAC’s definition of property, yet they were neither contracts nor services, so they were beyond the scope of OFAC’s designation authority.

OFAC’s conflation of “interest” with “property” was impertinent because the immutable smart contracts were not analogous to patents or copyrights. Tornado Cash did not receive any fees from them, and they did not entitle the smart-contract creators to a benefit. Patents and copyrights are ownable, anyway, just like everything else in OFAC’s regulatory definition, unlike these smart contracts. The OFAC catch-all still required “property” to be property.

Code, not contracts. The Fifth Circuit continued that the immutable smart contracts were not even contracts. OFAC contended, and the district court agreed, that the immutable smart contracts were “merely a code-enabled species of unilateral contracts,” but the Fifth Circuit said this ignored that unilateral contracts require an agreement between two or more parties, whereas the immutable smart contracts here involved only one party. Unilateral contracts are also revocable at any time before offeree completion of performance, and even if one could say the Tornado Cash developers made an offer by creating the smart contracts and publicizing their code, they revoked such offer and any role in it by making the code immutable such that it runs independently and autonomously. Even if Tornado Cash advertises the immutable smart contracts on its website, Tornado Cash did not own or control them.

The district court’s analogy to a vending machine did not pertain because a vending machine owner could revoke the open offer of vended goods, but here, Tornado Cash had no control over the immutable smart contracts. Once uploaded to the Ethereum blockchain, Tornado Cash could not change the code in any way.

Not services. The Fifth Circuit continued that the immutable smart contracts were not services. Again, once uploaded to the Ethereum blockchain, the immutable smart contracts did not involve any Tornado Cash effort and Tornado Cash did not own them. Tools used in performing a service were also not a service.

The case is No. 23-50669.

Judge: Willett, D.

Attorneys: Kannon K. Shanmugam (Paul, Weiss, Rifkind, Wharton & Garrison, L.L.P.) and Charles Lewis Ainsworth (Parker, Bunt & Ainsworth, P.C.) for Joseph Van Loon, Tyler Almeida, Alexander Fisher, Preston Van Loon, Kevin Vitale, and Nate Welch. Michael Shih and Sharon Swingle, U.S. Department of Justice, for U.S. Treasury Department, U.S. Treasury Department's Office of Foreign Assets Control, Janet Yellen, and Andrea M. Gacki.

MainStory: TopStory Blockchain CrimesOffenses CyberPrivacyFeed DataPrivacy FinancialIntermediaries FinTech GCNNews LouisianaNews MississippiNews Privacy TexasNews DataSecurity