>This kind of attack would be almost impossible in the pre-bitcoin era.... Instead democratizing currency, we're democratizing large scale crime.
Just wanted to make this same point - right now, cryptocurrency has negative value for society. Perhaps this is a justification for banning the current implementations.
In practice, though, it's not clear what exactly are the capabilities of each branch of law enforcement.
But, supposedly, putting a non-zero value in the "illegal income" field of the 1040 (which ISN'T fraud) both (1) can't be used as evidence against you in court, and (2) isn't reported by default to the IRS to the FBI or other law enforcement agencies, so you don't end up on any watch lists.
Of course you gotta take their word for part (2), but it is their incentive to get every tax dollar regardless of source.
That'd be the sort of counter-productive legislation we see too often. The only result would be to push this underground and to keep authorities in the dark. It might end up helping criminals.
A similar case has been made about corruption: If you're asked for a bribe by, say, a corrupt official you usually have no choice but to pay and once you have paid you are in it with them, both criminals, so no-one talks.
You may be able to clearly document the attempted bribery, and report it to the relevant authority—which may be a central agency of some form, or may be just going up the chain within the same organisation. Success will vary by country, authority and magnitude of offence. But even threatening to do this (politely) normally achieves the desired result, though it does nothing to actually uproot the corruption.
Alternatively, just indicate clearly that you’re not willing to play along with this illegal behaviour.
The zero rupee note (https://en.wikipedia.org/wiki/Zero_rupee_note) is a fairly successful example of doing this, and bear in mind that India corruption problem is much larger than any western country’s—although it’s illegal, it’s still par for the course in a great many areas. Yet standing up to this bribery is quite possible if only you have any inclination to do so.
I am currently in India, residing with another Australian who has lived in India for forty-odd years and operated business locally, and bribes were solicited from time to time, but he would not play ball, typically by either pretend nothing had happened (that is, ignoring any “hints” that you could pay for such-and-such) or by actively declining. Flunkies that try to take bribes personally are generally quite ready to backtrack once they see which way the wind is blowing (they could get in trouble with their boss), and more institutional bribery can generally be waited out, at the least. Even if it’s occasionally a long wait (like, months instead of days, or years instead of weeks).
A large part of the fight on these sorts of issues is changing cultural norms. Consider seatbelts over time in Australia (and much of the world): fifty years ago seatbelts were uncommon, but legislation was paired with a big marketing push to normalise wearing seatbelts had the effect that before terribly long society would look down with severe displeasure on anyone that didn’t wear a seatbelt while driving, so that now most people (well over 99% of the driving population, at a guess) wouldn’t dream of driving without wearing a seatbelt. The same is possible here, and will be far easier than selling ice to proverbial eskimos, because it’s easy to take the moral high ground in advertising (and moral high ground is almost as powerful as safety and “think of the children”): we will not parley with criminals.
> nd more institutional bribery can generally be waited out, at the least. Even if it’s occasionally a long wait (like, months instead of days, or years instead of weeks).
And in the real world that means you pay.
> wouldn’t dream of driving without wearing a seatbelt.
Because people understand that it is in their interest to wear a seatbelt. That's very different from paying a a bride that is often in the person's interest.
It was an Indian economist, and chief economist at the World Bank, that suggested making payment of bride legal to shift incentives [1]. You still have an incentive to pay but also an incentive to report it, while it increases the risk for the bribe-taker. Whether that would work or not, it recognises that the key to influencing behaviour is to create the right incentives.
That said, slashing the municipal police isn’t a terrible idea
That said, proponents do have a shot at enlightening us (me and other viewers of the thread). What large scale positive application are you aware of?
* Two set of fees to exchange crypto to fiat + transfer fee compared to one set of fiat currency exchange + transfer fee.
The biggest issue I have with cryptocurrency is that it’s an utter waste of resources. It incentivizes the consumption of electricity (and talent) purely to print money, rather than to produce value. Yes, currencies provide some value to society, but we already have more sustainable options.
I see the appeal if you hate taxes and regulations or live under a particularly oppressive regime. However, given that it relies, to some extent, on public infrastructure like internet and electricity that governments can outright shut off if they so desire, there are better options. Raw materials and bartering work pretty well. Just don’t invest in tulips.
Most of these countries barely have a stable internet connection or even stable electrical power, so I wouldn't surprised if these 'currencies' aren't so helpful in practice.
* Note that use by corrupt politicians to launder their ill-gotten gains is not a positive.
Yes, bitcoin can play a role but it's not like you're paying for your groceries in bitcoin. Cash under the mattress > blockchain
Perhaps these ransomware attacks are the market's way of making things... more fair.
Security improvements seem to be driven more by regulation (GDPR), competition (when did ElasticSearch release TLS support for free? Not after the Nth open ES cluster - only after Amazon competed with them), and large costs (switching to Linux servers because they're cheaper. Though there are concerns about current security practices there too...).
so, no.
In a perfect world, everyone can be trusted, and we don't need locks on our doors or passwords on our phones. In a dystopia, everyone has to carry a gun or have a bodyguard to leave their fortified homes, and a quarter of GDP goes towards security measures. We're somewhere in the middle, but things like this push us a little further down the road to more sunk costs in security measures.
A locksmith might make a killing after a local crime wave, but they should understand that crime is bad for the neighborhood regardless. Cyber crime raises demand for white hat services, but what's good for white hats is not necessarily good for society at large.
If it was a zero-day or something newer - defined by regulations - then the company is not liable.
Your analogies are cute but I want new laws, further making your analogies moot.
Bank Secretary : So, people hire you to break into their places... to make sure no one can break into their places?
Martin Bishop : It's a living.
Bank Secretary : Not a very good one.A ban would do serious harm to 2, 3 and 4. If no one could pay legitimately and it would become (ever more) difficult to launder, the ransomware demands would die. The first (connectivity) could be impacted as well. What would happen when traffic shaping makes sync take longer and when every LN transaction risks losing money due to disconnections?
1. Bitcoin transactions don’t require access to the internet at the time the transaction takes place. There have been solutions for performing offline transactions, though none have really taken off. Nevertheless, it’s not hard to do, though it’s riskier for the recipient than an online transaction. I won’t go into the technical details, but it’s nothing fancy. The idea is that you can place money in any number of accounts ahead of time, then simply pay people by handing them the keys to those accounts. There’s little overhead for creating new accounts; often merchants will use a fresh account for every transaction. Of course, the recipient has to be able to trust that they’re actually receiving keys to an account with the right amount of currency, which is a harder problem to solve.
2. This isn’t necessary. Bitcoin was popular in certain criminal communities long before there was any easy way to convert between Bitcoin and fiat. Cashing out dirty Bitcoin to USD remains risky.
3. The UX is already terrible. The UX that criminals experience isn’t the same UX that investors experience. They can’t use services like Coinbase to cash out.
4. Prior to Bitcoin going mainstream, the cover was that you could exchange your Bitcoin for various illegal products and services. (Want to buy a stolen car?) When there’s a whole underground economy whose participants are thoroughly convinced they are outside the reach of the law, any currency will work, as long as there’s a consensus within that community.
Banning cryptocurrency would have some interesting effects, but it would be nearly impossible to enforce, and it wouldn’t have the impact you’re seeking.
This would turn a 'trustless blockchain' to a 'non-blockchain relying on trust'. Assuming this transition can even be done (what would be the point of cryptocurrency in that case?), the result would be like the known hawala networks, which at least do not enable so much criminal activity and have some decent uses.
2,4. Bitcoin had an aura around it. Something experimental not really concerned with money or big crime, maybe a way to buy light drugs. Later on as a magnet for speculation. Remove the official cover, and laundering would become way more difficult.
3. There's terrible UX, and there's 'terrible horrible UX when one could easily lose money because the ISP closes your lightening connection'.
So I think this is possible to enforce, not completely, but there's no need for 100% enforcement to have a positive effect.
You can create the transaction object and hand that over. Transferrable literally as a file.
Instead of having over notes with the private key on them.
Eventually that transaction will need to be settled onchain. This can work in a world without a familiar looking ubiquitous internet. Regional internet cafes or even radio stations can settle signed transactions. People can have stocks of transactions and they just go to the cafe to settle those and also get their updated balance.
This capability always undermines a "ban crypto" thesis, or even a "crypto doesn't survive the apocalypse when the power goes out" thesis. It is merely a concept, just like computers communicating to each other is a replicable concept even if the head of state has an internet kill switch.
Anyway, we don't need a 100% effective ban to get an effect. A 90% ban may well be good enough for any practical purpose. Your example is a good one - sure, there are ways to get around 'internet kill switches' several countries have, but in practice these (unfortunately) work.
The fact that some people in a cafe can get one cryptocurrency transfer going is no defeat for a ban, so long as the ban is effective enough to reach its intended effects (e.g. making ransomware useless).
How would this be done? It only takes a single node capable of connecting to both networks to keep the whole thing working. There are already many nodes working with satellite connections so I'm pretty sure this can't be done even by state actors.
but the utility stays the same at $2.50 or $25,000 (offline-for-most, stateless monetary system with managed/predictable supply)
the same utility is inherited by most of other blockchain technologies
Banning banks from doing business with bitcoin exchanges is not banning bitcoin. Banning use of bitcoin entirely is legally plausible, but technically impossible to implement without draconian internet censorship on the scale of China. It's a 100x harder to ban bitcoin than, say, bittorrent, and banning that in a free society ended up not being possible.
If we can disrupt the network so that even criminals can't get ordinary people to 'pay' via the network, than it's for all practical purposes a ban.
I don't agree that banning it is harder than bittorrent. It's dramatically easier. Bittorrent doesn't have global state, so there's no one place to strike. The entire Bitcoin network depends on global consensus, and therefore there is one place to strike. If it is weakened so that it shrinks enough (how many miners will want to mine for an illegal activity?), than 50%+1 attack will be trivial for a state actor.
It's hard to say. The current fiat system, due to predatory and parasitic practices such as the inherent interest involved in working with it, and how the government is able to control inflation at will, is absurd.
Ehhhh, I think the overall impact of Bitcoin is negative, but the "democratizing large-scale crime" argument is a pretty poor argument for why that is. First, Bitcoin isn't "democratizing" anything good or bad--people need to stop using this word with regard to Bitcoin. But assuming you mean something along the lines of "enabling", or "empowering", I'm not sure that the shift in computer hacking crime which is caused by Bitcoin is actually negative.
Prior to Bitcoin, the people who paid for poor security were consumers whose data, money, and time were stolen. In theory if an entity exposes your data, you can sue them, but in reality, data breaches are common and when entities actually get sued, they rarely pay out significantly. I've followed the Equifax case every step of the way for years and still haven't received a dime, and I doubt many people would follow through all the hoops they've put in place--I'm mostly doing it out of curiosity at this point.
That still happens, but more and more, ransomware's biggest targets are large entities which should have secured their services better. Not only does ransomware punish the entities who should have prioritized security, not the consumers, it also makes it public knowledge whose security is lax.
Now there are a lot of complexities here. In theory, ransomeware hackers could also sell the data--but as far as I know that doesn't happen much, probably because they rely on the "honest crook" effect to ever get paid. And sometimes ransomware is employed against individuals.
And to be clear, I'm not endorsing ransomeware attacks. I'm just saying this looks like harm reduction to me: if a big business is going to not prioritize security and get hacked, then I'd rather they pay a ransom than have user's private data sold on the darkweb. In a more just system, that's just the fines they'd be paying anyway.
* I suspect that right now companies find it cheaper to pay than to improve their security.
[0] https://wtop.com/national/2020/05/texas-high-courts-hit-by-r...
[1] https://www.msspalert.com/cybersecurity-research/municipalit...
[2] https://www.wwnytv.com/2020/07/28/western-ny-hospital-recoun... https://edition.cnn.com/2019/10/11/us/alabama-hospital-ranso...
Aren't these the entities that you would most want to keep your data secure?
> Alleged better safeguarding of our data* isn't worth it.
> * I suspect that right now companies find it cheaper to pay than to improve their security.
That makes no sense, because if you don't improve your security, you'll be hacked in the same way again. There isn't an upper bound on how much it can cost to not improve your security.
I don't think the local municipality or the courts have anything I'd consider sensitive on me. Regardless, my bigger desire is for them to stay running, especially the hospitals. I'm not willing to temporarily shut some down 'for better security'.
>That makes no sense, because if you don't improve your security, you'll be hacked in the same way again. There isn't an upper bound on how much it can cost to not improve your security.
What actually happens is that the targets pay, and issue tougher mandates which may or may not be respected in their organization. These hacks are rare enough for now - I suspect hackers don't like to hit the same target again soon after (bigger risk of the target not paying you) - so eventually the organization slips back into same security morass they were in the first place, if they ever left it. There isn't a true desire to change.
Also, there is an upper bound if you're paying insurance, like that hospital did[0]. Over the long term insurers will raise their price, but at least it's a predictable bound.
[0] https://www.wwnytv.com/2020/07/28/western-ny-hospital-recoun...
More likely, other criminals will come knocking on the same company's systems and get that data for other purposes.
Yes. Or, they can get hacked again and pay another ransom until they learn their lesson.
An order of magnitude of more drugs are sold on Cash App and Venmo -- which is why they're in rap songs. As for large scale hacking, extortion and ransom, yes bitcoin is used but it is increasing difficult to cash out in a large way.
But its not? You can convert 50 million usd worth of bitcoin in one order without moving the market more than 1-1.5% and have a wire transfer to your bank account same day. This happens all day every day, with the markets getting deeper year by year.
Trash exchanges for retail have nothing to do with the infrastructure actually out there. If you are moving anything over 4 figures you shouldn't be trying to use retail exchanges. They're trash, slower, randomly flag stuff, and have higher fees.
its been like this for half of bitcoin's existence
they consider themselves distinct from exchanges because they do not take custody of people's funds, in their opinion
Almost all illegal bitcoin stolen by hackers and ransomware is cashed out in countries with limited or no AML/KYC.
It is actually difficult to cash out?
Unless you're best friends with an oligarch, and if that's the case, you can always get Deutsche Bank to do it for you.
I still don’t understand - how is Bitcoin difficult to trace when there is a global immutable public record of all transactions?
It's just a ledger kept outside so there is no link between the money going in and the money coming out.
There's also Zcash, which applies similar logic to all shielded transactions.
Can you not track all Bitcoins going in and out of a mixer?
This is an oversimplification, but it should give you a rough idea of how difficult it is to trace Bitcoin.
Granted, this is all theoretical. In practice, it’s not unusual for such people to make mistakes that reveal their identity; however, there’s nothing inherent to Bitcoin that ensures they can be de-anonymized.
Usually they attempt to go after hosting providers, but when the services are only accessible by Tor and they’re using bulletproof hosting—hosting providers who do their best to avoid law enforcement—that’s no easy feat. It’s not impossible, but it can be both a technical and diplomatic nightmare.
You'd be surprised. The feds have very advanced taint analysis if they have reason to go after you.
If the mixer has a lot of users, at best you could determine that the your target is among the entire set of people who used the mixer this hour/day. Although if the mixer was compromised, you’d have everything. That does seem like a substantial risk. It’s kind of like deciding to trust your vpn. You could mitigate that risk by using multiple mixers.
Perhaps they might do this if the saw keeping the entire 4m as much more lucrative than many years of taking the percentage skimmed off the top from a number of smaller transactions, and just going into "retirement".
Why would the mixer need to reuse addresses when you could create a brand new one each time.
On the other hand, the Feds arrested a kid in Florida, so my question is... how did they find him?
If I had to guess, the attack was done by a group of people and they split the funds up. Some of them were smarter than others.
It's also possible that the people who have been arrested are simply people who have received stolen goods (knowingly or unknownly). Perhaps they traded something else of value for the Bitcoin and didn't know how dirty it was.
Then bragged about it and went for more accounts. His friends left him when he went for the high profile accounts. I think it was organized on discord.
The one area where he claims it is an enabler is as a medium of exchange between criminal organizations. It's easier to transfer large quantities of currency and easier/cheaper to verify validity, than the traditional method of brokers and illicit escrows (nothing like the briefcase handoffs you see on TV).
But those same qualities that enable those types of transfers also enable transnational transfers of currency between nations that do not have agreed on standardized electronic methods. And I'd view that as an overall win. I'm also of the opinion that on a slow and steady long haul, cryptocurrencies will eventually take over the role of the US dollar as a trading base currency. Which would also be a win in my opinion, with respect to geopolitics.
Why not ban the encryption while we’re at it?
Instead of bashing it, how about we come up with solutions to the problems?
Just because you don't see a utility for it, doesn't mean it doesn't exist.
More people can do this but I think "almost anyone" is something of an exaggeration.
Why?
Currently you have to setup accounts with multiple companies in many different countries and pay fees to all of them, it's an absolute mess.
democratization works both ways. A democratized currency facilitates both crime as well as the oppressed - after all, you cannot tell the difference between them under an oppressive regime.
What you implied that we should have is a democratized currency that's _only_ good for non-criminals (and used for "good purposes"). That's impossible. It's like asking for a gun that you can't commit a crime with, but can be used to defend yourself with.
It could help middle class people get their money out of a given country but otherwise, where's the benefit?
Criminals don’t care about filing tax returns for digital assets, which is why we see them use it as currency. When you or I try to use it as a currency, we’d have to file a tax return if the value of it changes (at least in the US)
If we saw governments ease up on this a bit, we might see some interesting currency applications come if it, but I don’t see them letting go of that control.
The 4.5m would have to be mixed immediately so the original wallet can no longer be an event source.
Is that the right idea?
And dividing it up between as many possible independently run tumblers/mixers.
I'm sure some additional smurfing techniques could come into play for additional obfuscation.
Is it? VIPs are regularly held for ransom in unstable countries, so much so that ransom insurance is a thing[1]. If those ransoms can be safely received, why can't it be the case for ransomware ransoms?
[1] https://en.wikipedia.org/wiki/Kidnap_and_ransom_insurance
It streamslines it, yes, but it doesn't make it "almost impossible" to pull off like gp claims. Russia is listed as a "high risk" area in the wikipedia article for ransoms, so if they can pull off a ransom exchange (with human hostages) there, I can totally imagine russian hackers being able to pull off a ransom exchange with cryptographic keys. If anything, it's probably easier to pull off than a regular ransom because you don't have to contend with a human hostage.
Also, a quick skim of wikipedia[1] suggests that buying/selling of stolen credit card info predates the creation of cryptocurrency. If cybercriminals were able to find ways of transferring money back then, I'm sure ransomware authors can use the same methods to transfer money today.
[1] https://en.wikipedia.org/wiki/Credit_card_fraud -> https://en.wikipedia.org/wiki/Albert_Gonzalez -> https://en.wikipedia.org/wiki/ShadowCrew
From the comment you were replying to
> we're democratizing large scale crime. Previously only large organized crime organizations could perform such an attack. Now, almost anyone can.
That seems true and the main point. That it's gotten significantly easier for anyone to do this.
the recent price spike, as all other price spikes are the result of some (probably) nefarious activity that pumps real dollars in and out of the bitcoin platform.
In my time exploring Tor pre crypto boom 2017, I noticed markets of CP, Illegal Weapons, and Illegal services such as hitmen all operating under Bitcoin.
And I'm willing to bet that, since its inception till now, the number of transactions that was used for crime is greater than the number of transactions that weren't.
And I'm also willing to bet that the majority of the transactions that was used for crime, was to purchase drugs.
I do think we need to be concerned about Bitcoin and how it is a crime enabler.
>>And I'm willing to bet that, since its inception till now, the number of transactions that was used for crime is greater than the number of transactions that weren't.
Nice bet, but if you are wrong can I send you my bitcoin address?
This kind of attack would be almost impossible in the pre-bitcoin era. The difficulty of receiving that volume of money in that short of a period of time in a difficult to trace manner is a new thing.
We are entering a new era where crime can pay in very large sums with orders of magnitude less complexity.
Instead democratizing currency, we're democratizing large scale crime. Previously only large organized crime organizations could perform such an attack. Now, almost anyone can.