Building Blocks of Privacy: Why the Third-Party Doctrine Should Not Be Applied to Blockchain Transactions.

• Date: 01 April 2022
• Author: Lark, Veronica

TABLE OF CONTENTS I. INTRODUCTION 355 II. BLOCKCHAIN, CRYPTOCURRENCY, AND CRYPTOCURRENCY EXCHANGES 357 A. A Blockchain Is a Decentralized Public Ledger Allowing for the Execution and Storage of Cryptocurrency Transactions 357 B. Cryptocurrency Transactions Are Anonymous and Publicly Recorded in a Permanent Digital Ledger by Function of the Blockchain 359 C. A Cryptocurrency Exchange is a Third-Party Broker 360 III. THE CHAIN OF PRIVACY LAW: FROM MAILBOXES TO CRYPTOCURRENCY EXCHANGES 362 A. The Foundation of the Fourth Amendment and Evolution of the Third-Party Doctrine 362 B. There Is Mixed Treatment of Emerging Technologies Under the Third-Party Doctrine 364 C. Cryptocurrency Exchanges Are Third Parties in the Context of the Third-Party Doctrine 366 IV. A NECESSARY DISTINCTION: THE PROBLEM OF CONFLATING THE PUBLIC BLOCKCHAIN WITH THIRD-PARTY CRYPTOCURRENCY EXCHANGES 367 A. Cryptocurrency Exchanges Are Third Parties, but Carpenter Sets New Precedent for Finding a Privacy Interest when Emerging Technologies Involve Third-Party Transactions 368 B. Why the Ledger's Transparency Does Not Negate the Privacy of Actors Using a Third-Party Exchange 370 C. Law Enforcement Should Need Search Warrant to Obtain Personal Information Held by a Cryptocurrency Exchange 372 V. COURTS OR CONGRESS SHOULD RECOGNIZE A PRIVACY INTEREST IN BLOCKCHAIN TRANSACTIONS 375 A. Later Court or Congressional Developments Provide Future Opportunities to Distinguish Exchanges from Blockchain 375 1. Courts Should Look at Blockchain as an Emerging Technology, Distinct from Online Banking Apps and Cell Phones 375 2. Congress Needs to Assess the Gaps Created by the Emergence of New Technology with Legislation Like it Did with the 1978 Right to Financial Privacy Act 376 B. Blockchain Threats to Established Fourth Amendment Jurisprudence and Protecting Privacy in the Face of Criminal Activity 376 1. Carpenter Accommodates Blockchain in Its Analysis: Blockchain Does Not Require Special Protection 377 2. Criminals Do Not Evade Liability with this Proposal: The Third-Party Doctrine Should Not Reach Activity Outside a Third-Party's Possession 377 VI. CONCLUSION 378 I. INTRODUCTION

In early 2018, twenty-three million users logged onto Coinbase, presumably to confirm how much Bitcoin had spiked in price or maybe to swap their Ethereum for Litecoin. (1) For months leading up to this, people were swarming to cryptocurrency exchanges like Coinbase to see "blockchain" in action. Many were told--by friends, acquaintances, their boss--a brief elevator pitch about cryptocurrency along the lines of: "cryptocurrency is the cash of the future!" or "blockchain works without any third party, so that means your finances are more secure, since no one can tell who you are based on the digits that get stamped into the blockchain." To the millions who signed up for a Coinbase account, cryptocurrency may have represented a libertarian solution to the encroachment of large financial institutions. To others, it was an opportunity to engage in criminal behavior, thinking that the blockchain could conceal it.

In the context of recent court decisions in which defendants claimed privacy rights for data records stored on the blockchain, consumers may be surprised to learn that cryptocurrency exchanges like Coinbase are not legally viewed any differently than other financial institutions and intermediaries. (2) When individuals transact with third-party entities, such as using a bank to wire money, courts have held that individuals lose any privacy interest in the data they have shared because (1) it was shared voluntarily, and sharing voluntarily means that the individual assumes the risk of the information being shared with the government, and (2) the individual does not own the business record. (3) This legal concept is known as the third-party doctrine. The result is that third parties like banks do not need to be presented with a search warrant before they turn over client records. (4) This legal reality extends into digital space, applying to those types of transactions conducted via credit card on third-party applications like Apple Pay and Venmo. (5)

Additionally, this legal reality implicates blockchain transactions. (6) However, there is a critical distinction between a blockchain and a third-party cryptocurrency exchange like Coinbase. A blockchain has no third-party intermediary--it is a digital ledger--in contrast with a cryptocurrency exchange which serves essentially as a cryptocurrency brokerage. (7) Even though the blockchain and exchange are two distinct entities, law enforcement has successfully subpoenaed the Coinbase exchange with knowledge of recipient addresses: using this information to track down the accounts that sent cryptocurrency. (8) Cryptocurrency exchanges possess personal identification information for account holders, but this information does not carry over to a blockchain transaction; (9) at this point, this distinction does not prevent law enforcement from subpoenaing cryptocurrency exchanges when searching for account holders' information that may be connected to a given blockchain transaction even when the search is speculative and not based on probable cause. (10) In U.S. v. Carpenter, the Supreme Court recognized a privacy interest for a specific emerging technology, cell site location information (CSLI). (11) As another form of an emerging technology, blockchain should fit within the framework used by the Supreme Court in Carpenter. Even though the blockchain reveals cryptocurrency transactions to the public, the technology that allows for this revelation of data does not reveal the personally identifiable information shared with the cryptocurrency exchange: there is a distinction between the exchange's business records and the blockchain transaction. (12) The blockchain ledger is not a third-party intermediary, and, thus, any request issued to a cryptocurrency exchange to acquire accountholder information based on separate decentralized ledger transactions should require that law enforcement acquire a search warrant. Once law enforcement has identified a unique public address engaging in fraudulent or illegal transactions recorded in the blockchain ledger, this should require law enforcement to present a search warrant to a cryptocurrency exchange to obtain the records, since law enforcement does not yet have the requisite reasonable suspicion of a particular accountholder, and they will not know the accountholder's identity until the exchange turns over its relevant records. (13)

Part II lays out the factual background necessary to understand blockchain, cryptocurrency, and cryptocurrency exchanges. Part III assesses the origins of privacy law, the evolution of the third-party doctrine, and the application of the third-party doctrine in blockchain cases. Part IV proposes and analyzes why the distinction between blockchains and cryptocurrency exchanges is critical in third-party doctrine analysis. Part IV, Section A presents the basis for finding a privacy right in blockchain data in the context of Carpenter. Part IV, Section B looks at the distinction made between publicly revealed information and private information, and positions blockchain and cryptocurrency exchanges within this framework. Part IV, Section C proposes that law enforcement should be required to obtain a search warrant when seeking account information possessed by a cryptocurrency exchange. Part V presents potential solutions using both the court system and Congress, and also asserts why the blockchain/cryptocurrency exchange distinction does not overextend Carpenter and responds to potential issues concerning actors who will try to evade criminal liability based on the blockchain/cryptocurrency exchange distinction. Part VI concludes this analysis.

2. BLOCKCHAIN, CRYPTOCURRENCY, AND CRYPTOCURRENCY EXCHANGES

   This section provides a basis for understanding the components of a blockchain such as the decentralization of the blockchain, the nature of the ledger, and how cryptocurrency fits into this system. This section also explains the anonymity and permanence of cryptocurrency transactions and how a public transaction effectuates these qualities. This section also explains the technical qualities of a cryptocurrency exchange and how an exchange exerts control over users.

   1. A Blockchain Is a Decentralized Public Ledger Allowing for the Execution and Storage of Cryptocurrency Transactions

      Blockchain is a decentralized network comprised of a system of computer node participants that record transactions on a shared, immutable ledger. (14) Blockchain technology does not require a centralized third party, like a bank, to complete and store transactions; all participants share ownership of records so that no one user has full control. (15) The blockchain ledger is distributed because multiple computer nodes have authority to update the record on the ledger; there is no centralized party in control. (16) The nodes are essentially a network of computers that compete to complete mathematical equations under a given consensus protocol, and the computer that does this this computation correctly, and the most quickly, posts the entry into the ledger, thus adding a new block to the chain. (17) The "blocks" added to the ledger per transaction are immutable, in that with time it becomes computationally and economically impractical to reverse transactions, unlike the ease with which a transaction can be reversed or refunded in the traditional sense of being able to cancel a payment on a credit card. (18) A more accessible analogy in understanding the blockchain would be to imagine a web of computers that all have access to the same Google spreadsheet, and whenever a transaction occurs, it is entered into the spreadsheet after each participant races to complete a computation that confirms the validity of the transaction on the shared spreadsheet. (19) The spreadsheet entry...