Cyber insecurity
Estimated global cost of cybercrime
by 2019 according to market
analysts Juniper Research
Since 2008, when what is now known as blockchain
technology was first described, interest in virtual
currencies has grown exponentially, and they are an
increasingly established part of the global financial
system.1 But what happens when they are abused by the
dishonest? Andrew Bodnar reports
Cyber insecurity
Discussions have traditionally
focused on the security of the networks through which virtual currencies are operated, whether people
selling them can be trusted, and the
extent to which they can be abused to
facilitate criminal activity and money
laundering. This article takes a very
brief look at the issues around the
place of virtual currencies in the process of tracing assets so they can be
recovered for people from whom they
were stolen.
Imagine someone announced that
they were going to print their own
trading tokens, which people could
agree amongst themselves would be
used to buy and sell property, goods
and services, with no regulatory oversight, no control over who could be
part of the agreement and no central
register of either who those people
were or what they were using the
trading tokens for.
Imagine that same someone then
announced that after each transaction the trading tokens used would
be torn up, so the transaction could
never be undone, and new tokens
would be handed out in amounts
which reflected the parties’ new
shares of the overall trading tokens in
Imagine in turn that these trading
tokens became accepted as “payment” by companies and individuals
around the world. As those operating
in the fintech space know, this is a
very unkind analogy to describe virtual currencies.
We will begin with an analysis
of the tech behind virtual currencies. What follows is not intended as
anything approaching an exhaustive
study,2 but rather an overview which
grounds the discussion:
Andrew Bodnar
is a barrister at
Matrix, practising
in all areas of
asset recovery,
both criminal and
civil, as well as
corruption and
the recovery of its
proceeds, corporate
criminal liability,
civil and criminal
fraud, market
manipulation and
abuse, and money
laundering. He deals
with cases both in
the UK and around
the world
Distributed Ledger Technology (DLT)
is a very sophisticated version of
synchronised data-sharing. Different
bits of the Ledger may be in different
places, but they are reconciled to a
single data-set which all of the computers accessing and altering the
Ledger recognise and apply, something referred to as “consensus”.
Where the bits of the Ledger are in
different places, it becomes a “distributed consensus system”. So far the
primary application of DLT has been
to reconcile different activities carried
out in different areas, most often settlement of trades. There is however very
great excitement about the potential of
this technology, with academic institutions, open-source internet projects,3
and tech companies exploring its
various possible applications.
Take a sequence of completed steps
in altering a database (a “transaction”) and link them with a common
1. On 20 June, 2017, Bitcoin’s parent company estimated that there were Bitcoins in circulation with a
total combined value in excess of US$45bn
2. Which this author, as a lawyer, would be brave to
attempt anyway.
3. An example being Hyperledger.
Offshore Investment June 2017
“A contract to sell something or
supply services does not change its
nature only because the method of
payment is a virtual currency”
element (a “hash”). You now have a
“block”. Each time you create a new
block you hash it back to the previous
block. You now have a block chain.
Make it necessary for each new block
to be added at the end of the chain
(for example by including a piece of
unique code), and you have a blockchain. The first block in the chain is
called a genesis block.
Because the only way to alter the
database is to create a new block
making the changes, to update the
database one only needs to be able to
link back to the previous block, not
to the whole database. From a computing point of view, if a new block
needs to be added, only the computer
holding the last block in the chain
and the computer adding the new
block need to speak to each other.
It follows that the database can be
held and updated on a large number
of computers which are not permanently connected to each other, so
long as they are all operating the
same distributed consensus system.
This feature enables the database to
run much faster and more reliably
(because there is no central server to
become overloaded) and to be much
safer (because there is no central store
of data to hack, and the individual
blocks make very little sense on their
Create a database which records the
name of an individual (most likely
yourself) against units of value. That
is your genesis block. Allow people to
alter the name recorded against the
various units of value (a sequence of
hashed transactions). The alteration
of the record is a new block, which is
hashed back to the genesis block. The
next alteration is hashed back to the
previous block.
Give that database a name. Get
everyone operating the computers
that are hosting parts of the distributed ledger holding your blockchain
database to agree that they will
exchange real-world goods and services in return for the creation of new
blocks which alter the database so
that their name is recorded against
Offshore Investment June 2017
more or fewer of the units of value.
You now have a rudimentary virtual
From an economic perspective
it does not get more complicated;
the insertion of cryptography in the
blocks and the process of “mining”
those blocks (as Bitcoin calls it) to
ensure that they are genuine before
they are added to the blockchain
are concerned with maintaining
the integrity of the blockchain itself,
not with how the exchange of value
Bitcoin’s website4 contains a disclaimer which includes the following:
“The Website does not store, send or
receive bitcoins. This is because
bitcoins exist only by virtue of the
ownership record maintained in
the Bitcoin network. Any transfer
of title in bitcoins occurs within a
decentralized Bitcoin network, and
not on the Website.”
The language is of “wallets”, “coins”,
“transfers of title”, and bitcoins being
purchased on “exchanges” or directly
from current “owners”, but what
exactly is happening?
The “wallet” is in fact the DLT software which enables a user’s device to
become part of the blockchain network and add blocks to the chain.
A “coin” is in fact the unit of value
against which the user’s name is
recorded on the database.
An “exchange” is in fact a provider
which is able to source entries on the
database (usually from those wanting
to convert them into “real” currency)
for itself and which is prepared to add
blocks to the database in return for
“real” currency. Alternatively it is a
platform on which those who wish to
sell their entries on the database are
matched with those who wish to buy
entries on a database.
On a strict analysis, therefore,
when one speaks of a “transfer of
title” in a virtual currency a lawyer
should understand that there is a
transfer of a right to have one’s name
recorded in the blockchain database
against a certain number of units of
On a day-to-day basis, in the
context of legitimate trade, this is of
no consequence; a contract to sell
something or supply services does
not change its nature only because
the method of payment is a virtual
currency, and the obligations are
obligations of the parties to the
Similarly, where the anonymity
inherent in the use of a virtual currency is being abused to facilitate
Total number of
bitcoins in circulation
globally as at June 2017
real-world criminality, the fact that
drugs or guns are being paid for in a
virtual currency does not make their
sale and purchase any less criminal.
The same is true in respect of
laundering the proceeds of criminal
activity. The anonymity of the process, and the lack of any central datastore in a distributed ledger, make it
possible to conceal or even break the
link between the profits of a criminal
enterprise and real money in the
hands of the criminal.
That the chain is broken does not
impact upon the ability to prosecute
the launder; facilitating the breaking
of the chain is what constitutes
money laundering in the first place.
In Attorney General v Davis,5 the
Irish High Court had no difficulty
in acceding to a request by the US
authorities for the extradition of a site
administrator for the notorious Silk
Road website on, amongst others, precisely such a charge.
However, in asset tracing the chain
of property is all-important, especially in the Common Law world.
In Foskett v McKeown,6 Lord Millett
described the process of tracing as:
“…the process of identifying a new
asset as the substitute for the old.
… We also speak of tracing one
asset into another, but this too
is inaccurate. The original asset
still exists in the hands of the new
owner, or it may have become
untraceable. The claimant claims
the new asset because it was
acquired in whole or in part with
the original asset. What he traces,
therefore, is not the physical asset
itself but the value inherent in it.”
It is here that the difficulties begin
to emerge. In order to trace one asset
into another, it is necessary for there
to be two “assets”. So what is a bitcoin,
legally speaking?
The question has arisen in the context of taxation, and has given rise to
different answers.
In the United States, the Internal
Revenue Service has determined that
virtual currencies are “property” for
the purposes of US tax law.7 In Europe
the European Court of Justice concluded that such currencies are neither “property” nor a “currency” when
determining whether dealing in them
was subject to VAT.8
The ECJ went on to conclude that,
notwithstanding that virtual currencies are not currencies in the
traditional sense, trading in them is
a “financial transaction” because the
sole reason for their existence was as
a means of exchange.
The question has also arisen in the context of regulation of derivatives trading,
with the Commodities and Futures
Trading Commission in the United
States declaring virtual currencies commodities when deciding whether to
prosecute a company named Coinflip
and its principal for operating a market
in put and call options on bitcoins
without complying with appropriate
regulatory requirements.9
The fact that countries in the developed world cannot agree a uniform
understanding of whether a virtual
currency is property must surely be
cause for concern to those engaged in
asset recovery.
One must return to the analysis of
what one obtains when one buys a
unit of a virtual currency; the right
to have one’s identity entered in the
distributed ledger next to a certain
number of units. In itself this poses
no problem; a right to be included in
a ledger constitutes a chose in action.
The difficulty is that in a distributed
consensus system there is no single
entity to sue to enforce that right.10
Therefore the chose in action represented by a virtual currency unit itself
has no value.
Where a fraudster steals “real”
money and converts it into a virtual
currency, using the virtual currency
to acquire a physical asset, it may be
5. [2016] IEHC 497.
6. [2001] 1 AC 102.
7. IR-2014-36.
8. Skatteverket v Hedqvist [2016] STC 372.
9. In the Matter of Coinflip Inc d/b/a Derivabit and
Francisco Riordan CFTC Docket No. 15-29.
10. On its website Bitcoin’s parent company makes
clear to law enforcement agencies that it is unable
to freeze or forfeit bitcoins or alter the balance in a
bitcoin wallet because it does not store the information necessary.
Offshore Investment June 2017
that the answer will lie in the decision
of the UK Privy Council in Federal
Republic of Brazil v Durant International Corporation,11 in which it was
said that in order to succeed on a
tracing claim:
“…the claimant has to establish a coordination between the depletion
of the trust fund and the acquisition of the asset which is the subject of the tracing claim, looking at
the whole transaction, such as to
warrant the court attributing the
value of the interest acquired to the
misuse of the trust fund.”
The fact that a virtual currency
is used rather than a physical one
should make no difference; it is surely
irrelevant that the “real” money
was converted into a virtual currency before it was indirectly used
to acquire the physical asset, just as
in that case it was held to be irrelevant that a deposit of stolen money
was received into a bank account
shortly after the payment out of that
same account, if the two were clearly
But what of the situation where
a fraudster is still holding the virtual currency when he is called to
account? On this analysis the “property” the fraudster is holding is the
inherently worthless chose in action
of having a right to have his identity
included in the blockchain database,
because there is no central administrator.
He can very likely be made person-
Offshore Investment June 2017
“Solutions to these problems need
to be addressed at an international
level if they are going to be truly
effective in today’s global economy”
ally liable to a court order requiring
him to execute another transaction
transferring the virtual currency to
his victim, and the victim can then
make use of it to acquire value, but
it would seem the victim has no
enforceable right in respect of the virtual currency itself.
Similarly, what if the fraud consists of tricking someone out of units
of a virtual currency? The personal
liability of the fraudster may be clear,
but it is much less clear what legallyrecognised “property” the victim of
his dishonesty can point to in order to
begin the tracing exercise.
The Federal Republic of Brazil case
provides an illustration of the need to
address this issue sooner rather than
later. The Board of the Privy Council
said clearly that its decision was in
no small part based on a desire to
ensure that the law did not become
powerless in the face of “increasingly
sophisticated methods of money
The issue in the case arose because a
sequence of deposits and withdrawals
in bank accounts were not in fact
sequential, due to the exigencies of
the banking system. But with respect
to the Board, their decision was given
in 2015, when cross-firing money
between bank accounts and the use of
loans from third parties have been an
integral part of the money launderer’s
tool kit for over 30 years.
A stark illustration of the dangers of
such issues not being resolved is provided by the case of R v Preddy.12
In that case Mr Preddy challenged
his conviction for mortgage fraud on
the grounds that, when he secured
the admittedly fraudulent mortgage
advance, what he secured in law was
a chose in action against his own
bank which had belonged to him
from the moment of its creation; that
the chose in action of the mortgage
company against its own bank was
reduced was irrelevant to what he
had obtained.
He therefore argued that he could
not be guilty of obtaining property
from another by deception, since
what he had obtained had always
belonged to him.
The House of Lords accepted this
argument, and pointed out that the
same applied to a cheque, which was
a chose in action belonging to the
payee from the moment the cheque
was written.
As might be expected, chaos
ensued as trials collapsed and
people convicted of similar offences
appealed en mass against those
convictions. The UK Parliament had
to act quickly to change the law to
address the problem.
Legal certainty is vital in enabling
people to regulate their affairs, particularly as regards commerce and
property ownership.
Cautious and gradual evolution
of the law is therefore generally
much to be preferred. However,
given the pace at which technology
is advancing there are surely also
real dangers in that approach in the
fintech space.
As the differences in opinion about
how to categorise virtual currencies even for tax purposes shows, it
may well be that solutions to these
problems need to be addressed at an
international level if they are going
to be truly effective in today’s global
economy. ■
11. [2016] AC 297.
12. [1996] AC 815.
Was this manual useful for you? yes no
Thank you for your participation!

* Your assessment is very important for improving the work of artificial intelligence, which forms the content of this project

Download PDF