We find ourselves in the midst of a raucous debate among sanctions practitioners about the impact of the Fifth Circuit’s recent decision upholding a challenge against the sanctions the Office of Foreign Assets Control (OFAC) imposed on Tornado Cash, a cryptocurrency “mixer.” Does this case presage a sea change in how OFAC’s sanctions will apply to new technologies that may not clearly fall within the bounds of the agency’s 1970s-era statutory authority? Or is the Fifth Circuit’s ruling likely to be overturned, merely a statement of the obvious, so unclear as to have minimal real world impacts, or otherwise just a blip in the decades-long trend of judicial deference to OFAC?
This article unpacks the Tornado Cash decision, puts it in context with other similar cases that are also working their way through the courts, and tries to predict what the future may hold for challenging OFAC sanctions that target new types of technology.
But first, by way of brief background in a complicated saga, Tornado Cash is a software program that mixes cryptocurrency in various ways to help promote the anonymity of its users. It was initially created and managed by a “decentralized autonomous organization” (DAO), which later released it into the wild to operate independently in the form of an “immutable smart contract,” which now performs the crypto mixing in an automated manner, without any human involvement or control.
Epitomizing the Wild West of the digital world, Tornado Cash was sanctioned by OFAC in 2022 for facilitating money laundering by North Korean hackers among others. The Fifth Circuit decision stems from a challenge against the sanctions brought by a group of Tornado Cash users. The district court in Texas had initially thrown out their case against OFAC, which sought to kill the sanctions. That trial court showed traditional deference to OFAC’s broad interpretation of IEEPA, the statute authorizing the agency to impose these sanctions, thereby finding that OFAC did have the power to sanction Tornado Cash.
This is a case about statutory interpretation and the scope of OFAC’s authority under IEEPA. In targeting Tornado Cash, OFAC had already indicated that they were not sanctioning mere code or limiting anyone’s First Amendment rights to code to the day away. Rather, the sanctions applied to what OFAC found to be a thing that exists and that they called “the entity Tornado Cash,” i.e., the DAO, as well as associated virtual currency wallet addresses and a website (which is no longer on the Internet, but is apparently still accessible for those with useful skills). The district court agreed with OFAC that there is an “entity” that is associated with the Tornado Cash smart contracts and so upheld the sanctions.
But on appeal the Fifth Circuit right off the bat made clear its discomfort with the “sweeping delegated power” that OFAC has long enjoyed under IEEPA. Rather than focusing on whether Tornado Cash can be considered an “entity” that can be sanctioned, the appeals court cut right to the heart of OFAC’s authority under IEEPA, questioning whether this mixer, and in particular its “open-source computer code in the form of ‘immutable smart contracts,'” can be considered “property” under IEEPA that can be subject to OFAC’s “blocking” sanctions. The upshot of this analysis is that, even if an “entity” called Tornado Cash can be sanctioned in name, if it has no “property” that can be “blocked,” the sanctions would have no effect.
After trudging through a morass of technical detail about how Tornado Cash’s “immutable smart contracts” work, the Fifth Circuit found that OFAC had colored outside the lines set by IEEPA and granted the challengers’ motion for summary judgment. Specifically, the court found that this code can no longer be considered “property” since it has been unleashed into the wilds by the DAO and made “immutable,” as from that time on the Tornado Cash smart contract has been “unownable, uncontrollable, and unchangeable — even by its creators.”
This was a bold 180-degree turn by the appeals court. Many observers have since expressed alarm that the Fifth Circuit focused on such a technical analysis in seemingly brushing aside many decades of near-total judicial deference to OFAC, shackling this small but might agency in its critical national security mission. Viewed from this perspective, some have predicted that the case will trigger a tsunami of successful sanctions challenges in the future whenever a new technology does not clearly fit within OFAC’s IEEPA authorities, whereas courts traditionally have only been willing to dip their toes ever so gingerly into this highly sensitive world of national security targeting.
Those who believe the Fifth Circuit’s ruling has set the high-water mark for the almost complete deference that the federal courts have long shown to OFAC point to the court’s invocation of “the L word” (earmuffs for the DOJ readers: Loper Bright), a recent Supreme Court case overturning the longstanding Chevron doctrine of judicial deference to agency rulemakings when the underlying statute is ambiguous. To be sure, there are aspects of this decision that would have sent chills down the spines of the typically fearless attorneys in the Justice Department’s Federal Programs Branch. This is perhaps the first time that a federal court has used “the L word” in a national security case, as judges approximately 99.9% of the time in such cases allow the government to tell the court what the law is rather than doing their Marbury v. Madison duty. But the Fifth Circuit has gone back to that 1803 Supreme Court classic, and on its venerable foundation declared that definitions are to be found in dictionaries, and not in the minds of OFAC’s attorneys.
With that bold principle, they scoured the pages of not one, not two, but SIX dictionaries to arrive at the remarkable conclusion that “property has a plain meaning: It is capable of being owned.” In essence, the court came to the realization that, “because the software continues to operate regardless of the sanctions,” ipso facto and res ipsa loquitur it cannot be sanctioned. (While the court did not adorn this conclusion with such magic words, it may have been well-advised to do so, lest its authority be questioned by future generations of litigants.) Because a “trusted setup ceremony” was held in which these contracts were made immutable by “irrevocably remov[ing] the option for anyone to update, remove, or otherwise control those lines of code,” the contracts were deemed not to be “property” and thus beyond the reach of OFAC. (Scholars will continue to debate to what extent the nature of the “ceremony” motivated this finding, but a strong recommendation may be that if ever one is considering creating an immutable smart contract that may attract the ire of OFAC to do so as ceremoniously as one can bear.)
Despite the court’s huffing and puffing and blowing down OFAC’s lovingly stacked house of cards, another perspective is that this ruling may have little or no effect in the real world. One may even say this could all end up being nothing more than shadow boxing in response to a sanctions action that was doomed to be ineffective from the outset, after OFAC fired its biggest bazooka into the void of the digital world.
Since this code beast called Tornado Cash has been roaming the digital wilds with its leash cut, after having been freed by the DAO and made “immutable,” it effectively cannot be stopped. It has continued to mix crypto since OFAC hit it with the U.S. government’s largest sanctions sledgehammer — being listed as a Specially Designated National (SDN). An SDN designation is often a death sentence for international operators, particularly in the financial sector, but not so much in the libertarian paradise of crypto. Just look at how Garantex, the Russian crypto exchange that OFAC put on the SDN list more than two years ago, continues to make waves in the sanctions and money laundering world. They are surely entertained at Federation Tower in Moscow, where apparently many such organizations have been based.
So the skeptics say that the Fifth Circuit’s decision is a meaningless aberration, not a paradigm shift, and simply states the obvious: that these sanctions cannot be allowed to take effect because they cannot practically speaking have any effect over software code that nobody controls.
Moreover, it is not immediately clear what OFAC is supposed to do now that this ruling has come down. OFAC may not actually need to remove Tornado Cash from the SDN list, because all the court held was that Tornado Cash’s immutable smart contracts are not “property” and therefore that particular code cannot be regulated by OFAC. That does not necessarily mean that “the entity Tornado Cash,” if that is even a thing, or its wallets or URLs, need to be delisted. Indeed, if “the entity Tornado Cash” were ever in the future to have any “interest” in any “property” of “any nature whatsoever,” that “property” would then be subject to these sanctions if the entity remains on the list. Most things have property of some nature at some point, so OFAC may not want to take down this sword of Damocles just yet. For example, “the entity Tornado Cash” has crypto wallets, which OFAC, having laid claim to, surely will not want to relinquish. Perhaps most importantly, if “the entity Tornado Cash” determined, in its robot wisdom, that the current mixer is not mixing just right and needs to be tweaked, the wizards behind the curtain would need to run the OFAC gauntlet in order to do so — if they were to change the code, i.e., create a new “mutable smart contract,” this Fifth Circuit decision may not apply and the OFAC prohibitions may kick in.
So what does this ruling do? It says that OFAC cannot sanction the current immutable smart contracts, which were not much impacted by these sanctions in the first place. But it is certainly far from clear that U.S. persons are free to use Tornado Cash now that the Fifth Circuit has sent OFAC home with its tail between its legs. The mixer fans who brought this case may ultimately not have much to show for it beyond the headlines. For instance, a user would be well advised to consider if their own coins that they may throw into the mixer would become “blocked” under OFAC’s regulations based on Tornado Cash possibly having an “interest” in that “property” after it mixes the coins and sends them back out in altered form. Oh, and by the way, non-U.S. persons could face the risk of “secondary sanctions” should they provide “support” for the Tornado Cash “entity,” in which case they too may find themselves on the SDN list. It is also worth noting that if anyone anywhere were to act “willfully” (careful with those emails and texts!) and with a U.S. nexus in supporting a sanctioned crypto mixer that the government would prefer not exist, they may get an unpleasant 5 a.m. rousing by windbreaker-wearing, gun-toting U.S. federal agents (or any number of their global network of friends and collaborators). IEEPA carries stiff criminal penalties.
There is no question in the mind of any reasonable observer that the Fifth Circuit’s decision was a major generator of high fives, bead throwing, and the like for the court clerks in New Orleans — it’s not every day after all that attorneys get to give such a smackdown to the U.S. government in enforcing its core national security authorities by citing “Geeks for Geeks” and Satoshi Nakamoto. But it is quite possible that its impact ultimately may not be felt much beyond Bourbon Street. Of course, this remains to be seen.
The biggest question mark still lurking is how other similar court cases will go, as this Fifth Circuit decision will not be the federal courts’ last word on whether this digital beast has once and for all escaped OFAC’s clutches. In addition to the criminal cases being heard in Manhattan against “the Romans” (Storm and Semenov), who are alleged to have entered into a money laundering and sanctions evasion conspiracy by developing Tornado Cash, the Eleventh Circuit is hearing arguments that closely resemble the Fifth Circuit case, similarly brought to them by another set of Tornado Cash users.
The defendants in Manhattan have already filed new briefs arguing that the Fifth Circuit decision is sufficient for the charges to be dropped that they conspired to violate IEEPA by creating Tornado Cash. However, different standards will apply in that criminal case, which is also distinguishable in that it focuses on the initial development of these smart contracts and whether that was done knowing that it would lead to sanctions circumvention, rather than whether OFAC currently has the authority to add Tornado Cash to the SDN list and block its “property.” So the key case to watch at this point is in the Eleventh Circuit.
Just as the Texas district court and the Fifth Circuit approached the Tornado Cash case from rather different angles, the very similar Eleventh Circuit case challenging these sanctions also appears to have a distinct focus. The government filed a brief to the Eleventh Circuit on December 13, 2024, which contends that the Fifth Circuit case is not directly relevant, because the Eleventh Circuit proceedings have focused on whether Tornado Cash has any “interest” in these smart contracts, rather than whether they meet the definition of “property.” But the government also addressed the Fifth Circuit ruling head-on, asserting that the Eleventh Circuit should defer to OFAC’s view that the Tornado Cash smart contracts are “property” that can be sanctioned under IEEPA. Seeking to demonstrate the high stakes involved, the government’s brief points out that, if OFAC cannot sanction Tornado Cash, it may not be able to sanction any automated software or related services. This could call into question OFAC’s authority to regulate much of the financial activity in the modern world that occurs in an automated manner. The government argues that the highly technical “property” debate that was central to the Fifth Circuit’s decision is a red herring, and that the Eleventh Circuit should instead focus on the broader view that this mixer provides a “service” that can be regulated by OFAC, even if no “human effort” powers it.
It is anyone’s guess which way the Eleventh Circuit case may go. One thing that is clear though is that, if a circuit split were to emerge, the government will contend that is untenable for a federal regulatory program in so sensitive a national security area. In that case, we can expect the Supreme Court to step in and lay down the law, whatever that may be. Given the controversy that the Loper Bright decision itself has already stirred up, the Supreme Court may be cautious about throwing a similar bomb into the typically far more judicially stable national security arena.
Even the Fifth Circuit judges drew a distinction between Tornado Cash, on the one hand, and “the rogue persons and entities who abuse it,” on the other. The court also acknowledged OFAC’s “undeniably legitimate” concerns with the “illicit foreign actors laundering funds” by using this mixer.
The Eleventh Circuit — and perhaps ultimately the Supreme Court — will need to decide whether upholding the application of Loper Bright in national security cases is a viable approach. It may be much easier for a court to countenance opening its doors to more challenges against environmental, consumer protection, and similar rules, than it would be to welcome into U.S. court a new brand of litigants that the federal government has sanctioned for national security reasons. Courts for many decades have been hesitant to become too deeply involved in the government’s national security decisions, for understandable reasons.
So, while many have predicted the end of sanctions as we know them following the Tornado Cash decision, for others the smart money is on the government’s ability to prevail and convince the courts that Congress cannot be relied upon to legislate bespoke sanctions on every new type of technology as it emerges. The question for the courts in the coming months will be whether judicial deference to the government’s national security determinations is the only path forward in an increasingly insecure and technology-driven world.
