Internet Banking and Commerce: Security

Robert Hettinga

rah@shipwright.com

44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971

"Reality is not optional." --Thomas Sowell

Home Page: http://thumper.vmeng.com/pub/rah/

Visit for more related articles at Journal of Internet Banking and Commerce

[Yes - money laundering _again_.] I want to advance two theses:

1. That the interest and activities of governments in fighting money-laundering is directly contrary to the interest and activities of those seeking to develop anonymous digital commerce;

2. That there is a related, if not underlying, conflict between the rhetoric of concealment and the rhetoric of privacy.

(Of course, what _does_ underly all of this is individual vs. state -- but that is pretty much a given.)

If the push for anonymous digital commerce is exemplified by the Cypherpunks (and let's pretend it is), the battle against money-laundering is being led by the Financial Action Task Force (FATF), an autonomous international entity, set up by the G7 as part of the orgy of post-cold-war co-operation between States on this issue. The UN, G7, OAS, Commonwealth, EU and a host of supra- national bodies have called for co-ordinated action on stamping out dirty money. And in an unprecendented fashion, States have responded. There are over 100 States that either have or are considering the criminalisation of money- laundering. These include, by and large, the tax havens of Europe, the Carribbean and the South Pacific.

So what is criminal money laundering? Concealing the source of funds that one knows come from serious crime. Three comments about this formulation:

1. The state of mind required is knowledge, although this knowledge can be inferred from objective facts (and knowledge tests in criminal definitions are notoriously elastic).

2. The source of funds must be serious crime. The early UN declaration only referred to drug dealing, but since 1990 there has been a move to widen this to all serious crime. As to what constitutes serious crime, this is still somewhat up for grabs. Some of the BSA's statements about software piracy being the drug dealing of the nineties, and linking piracy with organised crime can be seen as a strategy to position large scale intellectual property theft as serious crime. More ominous (at least for the relationship of citizen and state) is the occasional reference to tax evasion in the same breath as serious crime.

3. This is because the serious crime need not be committed in the same country as the money laundering. This makes sense for conventional serious crime (to coin a phrase), but if tax evasion is included represents a major departure from the convention that the courts of one country will not enforce the taxing statutes of another.

Note also the possibility that fraud might be serious crime, which, since the test of fraud is dishonesty, directly brings the competing ethical (or rhetorical) systems into conflict. But more of this below.

The key feature of the new supra-national regime, however, is not a more or less co-ordinated criminal law (there are some marked variations on the above scheme), but the new surveillance approach to the financial system.

The most obvious signs of this are the requirement of financial institutions to "know your customer" (which includes an explicit prohibition of anonymous accounts) and to report "suspicious" transactions. But the approach goes much further. The FATF's chilling Forty Recommendations (on which the global approach is largely based) urges countries to "further encourage in general the development of modern and secure techniques of money management, including increased use of cheques, payment cards, direct deposit of salary cheques, and book entry recording of securities, as a means to encourage the replacement of cash transfers." [This is taken from a synopsis of the Recommendations.] In case anyone should think this is based on the insecurity to the _customer_ of cash and bearer securities, the FATF suggests countries (i.e. Governments) may like to consider monitoring all domestic financial transactions with a view to building databases for computer analysis -- such databases to be appropriately secured from unauthorised access, of course.

So there we have it. The FATF wants a cashless, book entry, universally monitored financial system based on verified True Names. Some Cypherpunks want a cash based, bearer certificate, mathematically unmonitorable financial system revolving around impenetrable pseudonyms.

Another way to put this is that Cypherpunks are for privacy, but the FATF is against concealment.

Three arguments are often made for the attack on money laundering.

1. Money laundering leads to the corruption of societies and the undermining of institutions and States. This seems to be putting the cart before the horse, somewhat. Even if you consider money laundering as an inextricable part of rendering crime organised, the crimes usually cited (drug dealing, environmental crime, and the smuggling of cultural artifacts [!]) could be decriminalised relatively easily. And of course you could always abolish the State :-)

2. Money laundering puts the financial system at risk. (This, of course, is why the financial institutions used in the Pizza Connection money laundering chain (Merrill Lynch, E F Hutton, Bankers Trust, Barclays, Chase Manhattan, Chemical Bank, Citibank, American Express and Thomas Cook. Bank of Nova Scotia, Ueberseebank (Switzerland)) have without fail spectacularly collapsed.) In so far as this is a result of legislation providing for the forfeiture to the State of the proceeds of crime, another solution is clearly available.

3. The War on Drugs has been a failure, because it isn't in anyone in the drug distribution chain's interest to assist authorities. The financial system is organised crime's exposed flank. (As an(other) aside, it is often mentioned (asserted?) that terrorists are turning to drug dealing etc to finance their terror campaigns. I'm not sure whether this is intended to combat the "drug dealers are just businessmen" argument, or the "terrorists are just patriots" one. Perhaps both.)

[Don't get me wrong. I'm not saying Statists are bad because drug dealers are good. I realise that reasonable people can differ as to the trade off between civil liberties and the protection of the State. I know people who think that it is all right to let the Police randomly breath test drivers in order to decrease road deaths. So I can easily imagine people might feel having to front up with two types of ID to open a bank account is a small price to pay to prevent the violence and misery of drug addiction. I happen to think both sets of people are wrong, and dangerously so.]

So governments fight money laundering to make it harder for criminals to enjoy the wealth governments can't stop them making. As a side effect, governments gain valuable intelligence about everyone's everyday finances. And we might as well look at cracking down on those evil tax evaders while we're at it...

Well -- even I'm willing to admit this summary is a tad glib. It misses something important about attitudes to secrecy: whether secrecy is about privacy or concealment.

Michael Froomkin often [:-)] cites Sissela Bok on the danger of secrets inappropriately kept (see e.g. A. Michael Froomkin, "Anonymity and its Enmities," 1995 J. Online L. art. 4, par. 51) -- and certainly the overtones of locked doors, masks, whispers and shadows makes "secret" itself a suspect word. To be open is almost always good; to be secretive is definitely always bad.

This sense of the inherent evil of secrets (dark secrets, guilty secrets) runs deep. Take the Equiticorp criminal trial (a local cause celebre of a few years ago) where executives of a company that failed spectacularly after the '87 crash were charged with (inter alia) conspiracy to defraud. The executives in question had caused a large sum of money of (at that time) completely unknown provenance (the so called H-Fee) to be paid to themselves through a series of companies in tax-haven/banking secrecy jurisdictions. The judge (there was no jury) found that, because no one had offered an honest reason to use such a structure, it could only have been for the purpose of concealment of the source of the money from those who may have had a legitimate interest in determining it (IRD, auditors etc.). This amounted to dishonesty, and the charge of conspiracy to defraud was made out.

Note the reasoning here: a secret without a reason is concealment; concealment is dishonest. (Cypherpunks would reason exactly oppositely: a secret is an expression of privacy; privacy is good.)

We can extend the concealment reasoning in an interesting way: concealment -> dishonesty -> fraud -> serious crime + concealment -> money laundering. So widespread concealment can (conceivably) give rise to an offence of money laundering with no other illegal act. The very fact that the State has an interest in detecting money laundering strengthens that first link: concealment - -> dishonesty.

For the cypherpunks, of course, privacy -> nothing at all. Secrecy=privacy is the default. Secrecy=concealment is a red herring.

This is not the forum to recite the virtues of privacy. So I'll leave you [at last, they cry!] with a sugestion as to its main (rhetorical) vice: privacy is opposed to public, and public is (usually) good. I'll go further. In the same way that "secret" gives rise to a cascade of negative associations, "public" gives rise to a chain reaction of happy, if not down right noble, thoughts: the public good; public service; the public's right to know; and, of course, the republic itself. Private (and privacy), on the other hand, gains meaning from its distinction from public -- it is _inherently_ negative.

All this is so much old rope for those who reject the linguistic turn in philosophy, but I find it a useful way of thinking about trends. And we are seeing trends towards individuality, the rejection of the collective, the privatisation of what once was public. Part of this will be the reversal of the privilegeing of public over private, and the consequent/connected move from secrecy=concealment to secrecy=privacy.

And a tangble manifestation of all that will be the rise of anonymous digital commerce, and the abandonment of The War on Some Money.