Annotating the blockchain

[ThomasV]

The recent allinvain and mybitcoin thefts have been terrible news, and the latter has strongly eroded confidence in Bitcoin. In addition, the SEPA bank accounts of at least two exchanges have been closed, not because banks are trying to destroy bitcoin, but because they are concerned by money laundering. I think we should try to stop this as soon as possible, before it gets too bad. We need to build collective tools that would allow us to detect and prevent laundering.

What I have in mind is an improved version of the blockexplorer website, where users would have the possibility to annotate their own transactions. Users would be allowed to annotate an address or transaction only if they can sign their message with the private key corresponding to the bitcoin address they want to annotate.

The site would allow users to report a transaction as fraudulent. In order to prevent abuses, a police report would be requested by the operator of the website in order to flag a transaction as fraud. Then, the website would allow all users to check if the bitcoins they receive have been involved in a fraudulent transaction. This could take the form of a webpage where users upload a list of bitcoin addresses, or it could be integrated directly to the bitcoin client with an API. A user receiving a positive answer could get in touch with the person who reported the theft, and the police would be able to start an investigation of the chain of intermediaries.

If such a tool was available, it would be easy for exchanges to detect and report thieves cashing out, because they know their real identities. If an exchange was unwilling to do so, its users would know quickly, because they would receive dirty money directly from that exchange.

What do you think ? If we, as a community, were able to unmask a bitcoin thief, I think the current lack of confidence could be reversed.

[1714901374]

1714901374

[elggawf]

So you accept Bitcoins from someone, and because their inability to choose the inputs for the transaction they send to you, you end up with some coins that were "unclean" a few transactions ago. Or maybe you don't realize this, because you don't happen to subscribe to the arbitrary group watchdog that monitors this shit - until you go to spend those coins and someone who is subscribed calls you a scammer.

[ThomasV]

Bitcoin was intentionally designed in order to make it difficult to regulate in the fashion you suggest. Any such regulation would run the risk that it could later be used to facilitate greater abuses.

The "confidence" in Bitcoin which has been "eroded" as you mention was foolish and unjustifiable. I do not lament its loss.

ByteCoin

AFAICT, Bitcoin was intentionally designed in order to make it impossible to double spend bitcoins, or create more than 21 million of them. Satoshi's paper does not say anything about favoring money laundering.

And I do not suggest any "regulation" of Bitcoin. I suggest a voluntary tool that would facilitate the tracking of fraudulent transactions.
If there is misplaced confidence, it is the confidence that Bitcoin is anonymous.

[CydeWeys]

Wouldn't this be very vulnerable to scamming in itself though?  It's trivial to, say, parse the top 10,000 receiving addresses from the blockchain that hold the most value at this moment.  What's to stop a scammer from taking a coin that's marked as "stolen" and transferring a single satoshi to each of these top 10,000 mostly valid addresses?  Wouldn't everyone just be marked bad at that point?

Remember, there's no way to "deny" a transaction.  Anyone in possession of coins that had been annotated as bad could go on to cause lots of trouble for other people very easily.

[jackjack]

recent allinvain theft

Wat?

[ThomasV]

So you accept Bitcoins from someone, and because their inability to choose the inputs for the transaction they send to you, you end up with some coins that were "unclean" a few transactions ago. Or maybe you don't realize this, because you don't happen to subscribe to the arbitrary group watchdog that monitors this shit - until you go to spend those coins and someone who is subscribed calls you a scammer.

The fact that you have unclean coins does not mean that you are a scammer, it means that the scammer is somewhere between you and the victim. If you end up with unclean coins, the website will allow you to get in touch with the victim of the scam/theft.

[payb.tc]

The recent allinvain and mybitcoin thefts have been terrible news, and the latter has strongly eroded confidence in Bitcoin. In addition, the SEPA bank accounts of at least two exchanges have been closed, not because banks are trying to destroy bitcoin, but because they are concerned by money laundering. I think we should try to stop this as soon as possible, before it gets too bad. We need to build collective tools that would allow us to detect and prevent laundering.

What I have in mind is an improved version of the blockexplorer website, where users would have the possibility to annotate their own transactions. Users would be allowed to annotate an address or transaction only if they can sign their message with the private key corresponding to the bitcoin address they want to annotate.

The site would allow users to report a transaction as fraudulent. In order to prevent abuses, a police report would be requested by the operator of the website in order to flag a transaction as fraud. Then, the website would allow all users to check if the bitcoins they receive have been involved in a fraudulent transaction. This could take the form of a webpage where users upload a list of bitcoin addresses, or it could be integrated directly to the bitcoin client with an API. A user receiving a positive answer could get in touch with the person who reported the theft, and the police would be able to start an investigation of the chain of intermediaries.

If such a tool was available, it would be easy for exchanges to detect and report thieves cashing out, because they know their real identities. If an exchange was unwilling to do so, its users would know quickly, because they would receive dirty money directly from that exchange.

What do you think ? If we, as a community, were able to unmask a bitcoin thief, I think the current lack of confidence could be reversed.

I'm attempting to build such a tool (gradually as I get time) in bitnot.es (http://bitnot.es)

i'm submitting more and more addresses as I find them each day (examples: http://bitnot.es/a/1vc3ZU4ae2cF6ZxqE44j5Ak3wfsZqybtb and http://bitnot.es/a/19QkqAza7BHFTuoz9N8UQkryP4E9jHo4N3) and hope others do too.

i think if it's built up it will make a good detective tool later. and for that purpose, i plan to add search features to it, so you don't need to know an address, you can just search for 'mybitcoin' for example and find any addresses/blocks/transactions that have been tagged as such.

lots of work left to do obviously, i've only just built the site a few days ago.

for more info, please see https://bitcointalk.org/index.php?topic=35178.msg437346#msg437346

[CydeWeys]

So you accept Bitcoins from someone, and because their inability to choose the inputs for the transaction they send to you, you end up with some coins that were "unclean" a few transactions ago. Or maybe you don't realize this, because you don't happen to subscribe to the arbitrary group watchdog that monitors this shit - until you go to spend those coins and someone who is subscribed calls you a scammer.

The fact that you have unclean coins does not mean that you are a scammer, it means that the scammer is somewhere between you and the victim. If you end up with unclean coins, the website will allow you to get in touch with the victim of the scam/theft.

Why would I want to do that?  I received the money in a legitimate transaction, presumably in exchange for something else that I no longer have.  Why would I turn around and give it to someone else?  Exchanges of currency in real life don't work like that.  Odds are that one of the bills in my wallet was stolen from someone at some point, but that doesn't mean that, if I could track down the original person it was stolen from, I should give it to that person.  I received these bills from bank, which gave them to me because my job deposits money into said bank.  I don't owe them to anyone else.  Likewise for Bitcoins.

[ThomasV]

I'm attempting to build such a tool (gradually as I get time) in bitnot.es (http://bitnot.es)

i'm submitting more and more addresses as I find them each day (examples: http://bitnot.es/a/1vc3ZU4ae2cF6ZxqE44j5Ak3wfsZqybtb and http://bitnot.es/a/19QkqAza7BHFTuoz9N8UQkryP4E9jHo4N3) and hope others do too.

i think if it's built up it will make a good detective tool later. and for that purpose, i plan to add search features to it, so you don't need to know an address, you can just search for 'mybitcoin' for example and find any addresses/blocks/transactions that have been tagged as such.

lots of work left to do obviously, i've only just built the site a few days ago.

That looks very nice ; do you plan to implement the features that I described ?
 1. make comments private : user can comment an address only if they have the private key corresponding to that address
 2. the website should flag stolen coins, based on police reports sent by victims
 3. a search engine that checks if bitcoins received on a given address have been reported as stolen in the blockchain. This engine should return the list of addresses between me and the victim, and allow me to contact the victim
 4. a simple API, so that I can query the search engine without a browser

(note: in order to do 1, the user will need to sign their comment with their private key. This is not possible with the current version of the client; but it should be added in the future)

[ThomasV]

Why would I want to do that?  I received the money in a legitimate transaction, presumably in exchange for something else that I no longer have.  Why would I turn around and give it to someone else?  Exchanges of currency in real life don't work like that.  Odds are that one of the bills in my wallet was stolen from someone at some point, but that doesn't mean that, if I could track down the original person it was stolen from, I should give it to that person.  I received these bills from bank, which gave them to me because my job deposits money into said bank.  I don't owe them to anyone else.  Likewise for Bitcoins.

I am not talking about reverting transactions, or owing something. I am talking about finding the identity of the scammer, or helping the police to find him.

[jimbo77]

2. the website should flag stolen coins, based on police reports sent by victims

How would you stop people falsely flagging addresses? Would they have to actually send you police reports?

[ThomasV]

2. the website should flag stolen coins, based on police reports sent by victims

How would you stop people falsely flagging addresses? Would they have to actually send you police reports?

Yes, a report containing the bitcoin addresses would be required. And once a case has been solved, the flag would be removed on those addresses.

[JoelKatz]

How would you stop people falsely flagging addresses? Would they have to actually send you police reports?

As I understand his scheme, a falsely flagged address wouldn't do any harm.

[payb.tc]

I'm attempting to build such a tool (gradually as I get time) in bitnot.es (http://bitnot.es)

i'm submitting more and more addresses as I find them each day (examples: http://bitnot.es/a/1vc3ZU4ae2cF6ZxqE44j5Ak3wfsZqybtb and http://bitnot.es/a/19QkqAza7BHFTuoz9N8UQkryP4E9jHo4N3) and hope others do too.

i think if it's built up it will make a good detective tool later. and for that purpose, i plan to add search features to it, so you don't need to know an address, you can just search for 'mybitcoin' for example and find any addresses/blocks/transactions that have been tagged as such.

lots of work left to do obviously, i've only just built the site a few days ago.

That looks very nice ; do you plan to implement the features that I described ?
 1. make comments private : user can comment an address only if they have the private key corresponding to that address
 2. the website should flag stolen coins, based on police reports sent by victims
 3. a search engine that checks if bitcoins received on a given address have been reported as stolen in the blockchain. This engine should return the list of addresses between me and the victim, and allow me to contact the victim
 4. a simple API, so that I can query the search engine without a browser

(note: in order to do 1, the user will need to sign their comment with their private key. This is not possible with the current version of the client; but it should be added in the future)

1. yeah that was sort of the idea i was going for in a thread entitled "encrypt/decrypt arbitrary text using bitcoin keys?" however i'm still not sure how that exact idea will be workable. I definitely do plan to make some notes private though (as an option for the submitter).

2. in addition to a straight tagging system, i could indeed implement other tick-boxes for the submitter, such as 'stolen'.

3. while i don't understand the detail of this question, i would think the search options would be continually expanded. i'm actually wondering about the possibility of basing the site off a heavily modified forum software instead of the current code, with each address/transaction/block basically recorded as a thread.

4. API will come with time too... not just for queries but i think there will be some cases where an API for submissions would be good. eg. every time a merchant generates a new address, they could voluntarily tag it and submit it to bit notes. ***i know this goes against most people's love of 'anonymous' bitcoin, but it will of course be voluntary, and it'd be up to users to decide whether they use a site which automatically submits notes.***

[elggawf]

I am not talking about reverting transactions, or owing something. I am talking about finding the identity of the scammer, or helping the police to find him.

... and so how do I reconcile that aspect with my company's privacy policy where I won't give out information about them without a court order instructing me to do so?

So I came for the loony libertarian pseudo-anonymous cryptocurrency, and I stay to give out my client's information because they happened to be six degrees of separation from a scammer?

Fuck everything about this idea.

[nhodges]

The recent allinvain and mybitcoin thefts have been terrible news, and the latter has strongly eroded confidence in Bitcoin. In addition, the SEPA bank accounts of at least two exchanges have been closed, not because banks are trying to destroy bitcoin, but because they are concerned by money laundering. I think we should try to stop this as soon as possible, before it gets too bad. We need to build collective tools that would allow us to detect and prevent laundering.

What I have in mind is an improved version of the blockexplorer website, where users would have the possibility to annotate their own transactions. Users would be allowed to annotate an address or transaction only if they can sign their message with the private key corresponding to the bitcoin address they want to annotate.

The site would allow users to report a transaction as fraudulent. In order to prevent abuses, a police report would be requested by the operator of the website in order to flag a transaction as fraud. Then, the website would allow all users to check if the bitcoins they receive have been involved in a fraudulent transaction. This could take the form of a webpage where users upload a list of bitcoin addresses, or it could be integrated directly to the bitcoin client with an API. A user receiving a positive answer could get in touch with the person who reported the theft, and the police would be able to start an investigation of the chain of intermediaries.

If such a tool was available, it would be easy for exchanges to detect and report thieves cashing out, because they know their real identities. If an exchange was unwilling to do so, its users would know quickly, because they would receive dirty money directly from that exchange.

What do you think ? If we, as a community, were able to unmask a bitcoin thief, I think the current lack of confidence could be reversed.

Similar to payb.tc's new project, we at Bitcoins For Charity have been working on a service that provides a "meta-data" layer that rests upon the existing blockchain, allowing users to mark transactions with publicly available notes. Very interested on getting more input before we make the source code repository public, and then shortly after that, launch to the Bitcoin community!

https://bitcointalk.org/index.php?topic=36058.0

[JoelKatz]

I am not talking about reverting transactions, or owing something. I am talking about finding the identity of the scammer, or helping the police to find him.

... and so how do I reconcile that aspect with my company's privacy policy where I won't give out information about them without a court order instructing me to do so?

Easy, you don't give out any customer information without a court order instructing you to do so. See how easy that was?

So I came for the loony libertarian pseudo-anonymous cryptocurrency, and I stay to give out my client's information because they happened to be six degrees of separation from a scammer?

It is a common misunderstanding of Libertarianism that you get to to do whatever you want to do exactly they way you want to do it. In fact, other people also get to to do whatever they want to do to the same extent, and if that includes revealing information that you would prefer to keep private, that's tough.

[payb.tc]

It is a common misunderstanding of Libertarianism that you get to to do whatever you want to do exactly they way you want to do it. In fact, other people also get to to do whatever they want to do to the same extent, and if that includes revealing information that you would prefer to keep private, that's tough.

also, if something's been submitted to my site, there's a good chance it was already public information beforehand. (just like the above 2 example links I gave).

[elggawf]

JoelKatz: Okay, so someone buys something from me using coins who were a few hops down the line was scammed or stolen from someone. Keep in mind that at every step of the way no one gets a choice of what coins they receive, which they spend, etc. As stated previously, pick any of the richest BTC addresses and send some scammed coins there - now what happens?

Anyway, so I spend those coins on to someone else who happens to be participating in one such bullshit there's-no-regulation-so-let's-invent-some scheme, who turns around and goes "STOP! I just got these coins from XXXX Company."

The pitchfork and torch-bearing mob comes to my doorstep and I say "fuck off until you get a court order", which they probably won't get because it's a fishing expedition separated by several hops from my client whom I'm protecting due to my privacy policy (or I might be a company that doesn't particularly care to identify Bitcoin clients for whatever reason). One of two things happens at this point:

1) Either the system proves ineffective - all you've got to do is find a few people to trade with who either don't need you to identify yourself in any way or don't participate in the scheme;

2) I'm ostracized by my lack of helpful participation: aka picking up my pitchfork, lighting a torch and joining the mob.

I'm leaning towards probably the second situation happening, because in general people filled with impotent rage on the internet won't simply go home and cool off once they realized their plan won't succeed. So in that case, fuck everything about this stupid idea. In an attempt to fix the "bitcoin is irreversible and pseudo-anonymous" thing (which can arguably be considered a feature rather than a flaw), we do our best to turn the complete-history-back-to-genesis thing into a flaw as well.

[ThomasV]

JoelKatz: Okay, so someone buys something from me using coins who were a few hops down the line was scammed or stolen from someone. Keep in mind that at every step of the way no one gets a choice of what coins they receive, which they spend, etc. As stated previously, pick any of the richest BTC addresses and send some scammed coins there - now what happens?

The guy who stole 75000 bitcoins from mybitcoin.com is not going to spend them inside the bitcoin economy; he is much more likely to convert them to fiat. This is because in the world we live in, where bitcoin has still not taken over, inferior currencies such as the dollar or euro are still being used by most people, and are still useful, no matter how inferior these currencies are :-).

This means that the "someone buys something from me using stolen bitcoins" scenario will most likely be "someone receives partially stolen bitcoins from an exchange". When this happens, if the receiver contacts the victim, the victim can forward the bitcoin addresses to the police, and the exchange will receive a court order. With a court order, the exchange will have to provide information on how the money has been laundered, and on which bank account it ended up. Money can be tracked in the real world, perhaps not as easily as in the blockchain, but it can be tracked at least by interpol.

If this could lead to the recovery of the money cashed out by the scammer, I am sure Bruce Wagner would be very happy and smile again, even if he would recover fiat money instead of bitcoins. More important, catching a thief with the help of the blockchain would have a tremendous impact in the media, and it would dramatically change the image that the general public has of Bitcoin. Such a feat would certainly help exchanges to get to do businesses with banks, without having their accounts frozen on suspicion of mauney laundering.

[indio007]

From The Cyclopedia of Law and Procedure.
http://books.google.com/books?id=7HMEAQAAIAAJ&pg=PA362

 

Stolen Property. A bona fide purchaser obtains no title against one from whom the goods were stolen, except in the case of negotiable instruments.

Federal Reserve Notes are negotiable instruments. Bitcoin is meant to pass like money but they are not promises to pay.
They aren't chattel either. They are more like an  incorporeal hereditaments.

It's so new and original I don't think anything in present law encompasses them completely. However the fact that is meant to pass like money would incline the courts to treat it as a negotiable instrument. The reason negotiable instruments are excepted from the rule regarding stolen property was the "necessities of commerce and sound public policy".

That doesn't mean someone in possession of stolen goods that has notice of the good's tainted character gets a free pass. They can still be sued for it's value. Their recourse is to sue the person they received the stolen property from ....up the chain of transfers to the original thief.

[elggawf]

ThomasV:

So why does anyone else need to participate, when the exchanges can just watch for such annotations?

What happens if Bitcoin does reach the point where it has utility outside of converting to fiat after being stolen?

How do you verify that the coins were actually stolen or scammed?

IMHO, this whole idea just makes Bitcoin far less attractive than the possibilities for irrecoverable theft ever did.

[ThomasV]

So why does anyone else need to participate, when the exchanges can just watch for such annotations?

You are right. Exchanges can watch for such annotations, and I hope they will do it.
However, it is currently complicated to track stolen coins, and exchanges might have other priorities.
If a website makes that information publicly available for everyone, then I guess exchanges will have an incentive to use it, because they do not want to return stolen coins to their clients.

What happens if Bitcoin does reach the point where it has utility outside of converting to fiat after being stolen?

This is a bit far fetched... anyway, if Bitcoin ever reaches that point, it will be much less vulnerable than today.
Currently, the Bitcoin economy is not safe at all; it is threatened by the fact that exchanges might be shut down and their bank accounts frozen. This is my main concern, and what I propose is a solution for today's problems.

How do you verify that the coins were actually stolen or scammed?

This is the job of the police. When someone goes to the police and files a complaint, there is always the possibility that he made it up. The website would require a police report in order to flag coins as stolen.

IMHO, this whole idea just makes Bitcoin far less attractive than the possibilities for irrecoverable theft ever did.

Seriously ? for thieves and scammers, maybe. But some people here would like to expand the Bitcoin economy to other circles of society.

In any case, what I propose is not to change Bitcoin, but only to make some information available. Bitcoin is not really anonymous, and the idea that you can use Bitcoin anonymously is a misconception. This misconception has led some US senators to call for a shutdown of exchanges. Let us try to avoid that.

[indio007]

This is the job of the police. When someone goes to the police and files a complaint, there is always the possibility that he made it up. The website would require a police report in order to flag coins as stolen.

This is a good idea , but I would go one step further. The complaint must be verified under the penalty of perjury and/or supported by sworn affidavit. That way not only are they under the jeopardy of failing a false report there is also the jeopardy of perjury.

[elggawf]

Seriously ? for thieves and scammers, maybe. But some people here would like to expand the Bitcoin economy to other circles of society.

Yes, seriously. If a consumer gets their shit robbed from their bank accounts, or their credit card gets cloned... it's a minor inconvenience, but they're mostly not liable for very much of it at all. With Bitcoin the opposite is true, but with the caveat that your money's much more secure if you're super-human enough to follow all the best practices to a T (though I'd imagine this part will get better).

You're trading away all the cute things about Bitcoin, in exchange for bringing back a little bit of security from the system that's already there. Except this security is nowhere near as good, because you basically have to wait for the person to try cash the coins out in order to have any chance at pressing charges. Furthermore, all it takes is for someone to figure out a way around the scheme and it all falls apart.

[JoelKatz]

One of two things happens at this point:

1) Either the system proves ineffective - all you've got to do is find a few people to trade with who either don't need you to identify yourself in any way or don't participate in the scheme;

2) I'm ostracized by my lack of helpful participation: aka picking up my pitchfork, lighting a torch and joining the mob.

3) The system ignores you, you're just a bit player. But it succeeds because bigger players cooperate because they understand that these thefts hurt the bitcoin economy their businesses rely on.

[markm]

... and so how do I reconcile that aspect with my company's privacy policy where I won't give out information about them without a court order instructing me to do so?

Easy, you don't give out any customer information without a court order instructing you to do so. See how easy that was?

Joel you're a frikkin genius! Brilliant.

-MarkM- (No more "its one of Mr Wilde's", in future it'll be "its one of Joel's" )

(His majesty is like a stream of...)

[Lolcust]

Last time I checked, neither USD cash nor gold ingots  nor digital stuff like Pecunix or  Liberty Reserve have an open "scum-tracker" annotation system built into them (though I think that Libres and Pecunix logs are probably quite long-lived ones).

None of those systems fail because their respective value storage units can be stolen and no system is readily available to track the lost resource (I could, theoretically, track down a local goldbug and raid his coin storage, and there would be no way to provably discern gold so procured from "legitimate" gold... however, and strangely enough, that does not seem to decrease the viability of gold).

Thus, I am profoundly unconvinced that there exists a need for such system in the bitcoin environment.
Of course, in a libertarian setting, everyone is free to set up their little bitcoin annotation service   I, for one, prefer #bitcoin-police due to the fact actual intelligent agents are involved, as opposed to  a blind and deaf script recording every claim John Doe makes in regards to a given bitcoin address / transaction