Risk of the police misidentifying the owner of an address

[JorgeStolfi]

I wonder if the anonimity of bitcoin addresses could create risks of misidentification of address owners by the police, even for people who have never used bitcoins.

Suppose that a "bandit" X generates a new address A1, deposits a pile of "dirty" bitcoins in it.

X then makes some small purchase from a retailer Z, pretending to be some other person Y who has nothing to do with the matter.  He provides Y's physical address for delivery (if the purchase is a physical item) and pays in bitcoins out of address A1 to the retailer's address A2. Then X moves the rest of the dirty coins from A1 to a tumbler, or whatever.

While following the trail of the "dirty" bitcoins, the police gets to address A1, notices the small transaction to address A2, that they recognize as belonging to retailer Z. From the retailer's record of the purchase, they identify Y and conclude that he must be the owner of address A1 and hence of the "dirty" coins.

For bandit X, the purpose of this this ruse would be to delay the police's pursuit, or even permanently derail it.  He could choose the innocent decoy Y so that the suspicion would seem plausible -- eg. someone not very computer-savy and with criminal background, large debts, drug addiction, etc. 

Many variants of this trick seem possible.  Bandit X could do the same with dozens of decoys, to get the police bogged down into checking dozens of false leads. 

Is this risk significant?  If so, how could it be reduced?

Criminals already use this trick with bank accounts. However, the risk for bandit X is very high in the bank version, because he must steal Y's identity and impersonate him when creating the bank account A1.  On the other hand, the police usually can figure out very quickly that Y did not create that account nor issue the payment and transfer orders.  (Here in Brazil, the innocent victim Y is called "an orange" in fraud jargon, and he is usually some poor semi-literate guy who does not even have a bank account and lives far from the branch where the account is opened.)

With bitcoin addresses, however, the risk for X is very small, since he does not have to get Y's documents nor interact with anyone else to pull the trick, other than issue the bitcoin transaction requests and the bogus purchase order in Y's name; while Y can be any person in the world, and he has no way of proving to the police that he is not the owner of address A1 and did not make the fatal purchase.   His only hope is that the police can trace the path of the purchase order and/or the bitcoin transaction requests on the internet, and determine that they could not have been issued from any computer that Y could have accessed.

[BurtW]

I don't see any difference legally between these "dirty" BTC deposited at a Bitcoin address and dirty USD deposited at a bank.

[JorgeStolfi]

I don't see any difference legally between these "dirty" BTC deposited at a Bitcoin address and dirty USD deposited at a bank.

Indeed they are the same thing, the problem is that it seems much easier to tie an innocent person to a "dirty" bitcoin address than to a "dirty" bank account.

EDIT: Note that, in the original scenario, address A1 is created and controlled by X, not by Y.  So it is  not the same thing as depositing dirty money into someone else's legitimate bank account (or dirty coins into someone else's legitimate address).  The crucial difference is that X can take out the bulk of the dirty money from that account.

[Peter R]

I think your example shows why this fear is misplaced.  In fact, I think it shows once again how bitcoin tends to align the incentives of the individual with the interests of the community.  

You demonstrated how Bandit X could easily link "dirty" BTC to Person Y.  But then Bandit X could create similar links to Person A, B, C, …. too.  Successful bandits are incentivized to add as much confusion as possible so that the apparent links lose there meaning and they can more easily spend their loot.

But this is also in the best interest of the community.  If the financial links lose their meaning, it becomes more efficient for police to stop crime by "stopping the crime in the first place."  If it is more efficient to stop crime in the first place, this is where I expect police will direct their efforts.  If this is where they direct their efforts, the community likely wins both by having less crime, and by having less fear of being hassled for non-crimes.

Win-win.  

[JorgeStolfi]

You demonstrated how Bandit X could easily link "dirty" BTC to Person Y.  But then Bandit X could create similar links to Person A, B, C, …. too.  Successful bandits are incentivized to add as much confusion as possible so that the apparent links lose there meaning and they can more easily spend their loot.

You seem to be assuming that the "bandits" will act in the smartest way possible, and that the police will assume that they do so.  To my knowledge, neither is true: bandits often make mistakes, and the police depends a lot on them doing so

But we'll have to wait and see, I guess...

But this is also in the best interest of the community.  If the financial links lose their meaning, it becomes more efficient for police to stop crime by "stopping the crime in the first place."  If it is more efficient to stop crime in the first place, this is where I expect police will direct their efforts.  If this is where they direct their efforts, the community likely wins both by having less crime, and by having less fear of being hassled for non-crimes.

Discouraging crime depends on  the police being reasonably efficient at catching criminals after the fact, more than catching them when they attempt to commit the crime.  If murderers, thieves, rapists could only be caught on the act, they would only have to commit their crimes when the police is not around.

I don't  see how one could stop the continuing epidemics of goxitis -- "hackers stole all your bitcoins, sorry" -- and other forms of bitcoin theft except by tracking the stolen coins and identifying the thieves.   Are you saying that this will not be possible, and should not be?

[Peter R]

You demonstrated how Bandit X could easily link "dirty" BTC to Person Y.  But then Bandit X could create similar links to Person A, B, C, …. too.  Successful bandits are incentivized to add as much confusion as possible so that the apparent links lose there meaning and they can more easily spend their loot.

You seem to be assuming that the "bandits" will act in the smartest way possible, and that the police will assume that they do so.  To my knowledge, neither is true: bandits often make mistakes, and the police depends a lot on them doing so

But we'll have to wait and see, I guess...

I am only assuming that the smartest "bandits" will act in the smartest way possible.  The stupid "bandits" will get caught.  I actually agree that your concern is somewhat valid now, but I am describing what I foresee to be the equilibrium point in the future.  

But this is also in the best interest of the community.  If the financial links lose their meaning, it becomes more efficient for police to stop crime by "stopping the crime in the first place."  If it is more efficient to stop crime in the first place, this is where I expect police will direct their efforts.  If this is where they direct their efforts, the community likely wins both by having less crime, and by having less fear of being hassled for non-crimes.

Discouraging crime depends on  the police being reasonably efficient at catching criminals after the fact, more than catching them when they attempt to commit the crime.

What matters to most communities is actually stopping the crime that affects them.  The police should use methods that are efficient for doing so.  If tracking financial transactions and hassling innocent people become less efficient, I think police will switch to using more effective methods.  I don't see how this is anything but a good thing.  

If murderers, thieves, rapists could only be caught on the act, they would only have to commit their crimes when the police is not around.

I never said police had to "catch people in the act."  If police can track down a murderer or rapist by interviewing witnesses, looking at evidence, performing DNA analysis, … you know, actual police work, then they should do it.  That would be an efficient way to help stop crime.  

But what does monitoring financial transactions have to do with fighting murder or rape, anyways?

I don't see how one could stop the continuing epidemics of goxitis -- "hackers stole all your bitcoins, sorry" -- and other forms of bitcoin theft except by tracking the stolen coins and identifying the thieves.   Are you saying that this will not be possible, and should not be?

No.  And to protect ourselves from these threats we need a secure way to store, transport and exchange value with other users across the world, without the assistance of a third-party or the permission of an authority.  It would be nice if we just needed to guard one piece of information to secure our funds too.  Something like a 78-digit number that nobody could ever guess.  

I bet something like that would really catch on.  

[RodeoX]

I would guess you have some protection from this because it must be proven that you are the owner of the address. The police may suspect you are the crook, but they can't convict on that suspicion.

[hello_good_sir]

I would guess you have some protection from this because it must be proven that you are the owner of the address.

Actually no, they will just charge you with the crime of not sharing your private key.

The police may suspect you are the crook, but they can't convict on that suspicion.

Maybe in TV and movies, but in real life it is very easy to convict an innocent person.

[Ardenyham]

First police would need to identify the shop based on the Bitcoin address only.
Wish police is putting so much effort when computer is hacked and Bitcoins stollen...

[JorgeStolfi]

I don't see how one could stop the continuing epidemics of goxitis -- "hackers stole all your bitcoins, sorry" -- and other forms of bitcoin theft except by tracking the stolen coins and identifying the thieves.   Are you saying that this will not be possible, and should not be?

No.

You mean "will not be possible an shouldnot be", right?

And to protect ourselves from these threats we need [ something just like bitcoin ]

Sorry, my point is that bitcoin is not the solution to the problem, it is its cause.

Safe ways of storing bitcoin keys will not prevent bitcoin thefts, any more than physical safes can stop white-collar crime.

Can you suggest how the police (or the bitcoin community, or the victims) could identify a bitcoin thief -- say, the MtGOX thief -- other than by tracking the stolen coins, and hoping to find such cues?

Don't you agree that a hacker or an insider could steal half a  million bitcoins without leaving any other clues?

If the MtGOX thief gets away and keeps the stolen bitcoins, why would other people faced with similar opportunites not take advantage of them?

Someone posted on another thread an  e-mail of some e-store (Survival Food) that used MtGOX as a payment processor, presumably lost money in it, and is re-evaluating their adoption of Bitcoin because of "the Bitcoin community reaction to the MtGOX situation".  I think I know what they mean. The inevitable corollary of the dogma "government is evil, police is evil" is "there is no crime, there are no criminals and victims, only smart guys and stupid guys".   

[JorgeStolfi]

First police would need to identify the shop based on the Bitcoin address only.

The store may have posted it on their webpage, why not?

If not, the police may get it from "Google for cops", a variant of Google that does not automatically censor items that may be sensitive personal data, like credit cards, SSNs, passwords, bitcoin addresses (or keys)...  The bandit X may even help them by leaving the address and store name posted on some public site, such has this forum.

As a last resort, the police could ask the friends at NSA; they know everything (even who is the real Satoshi).

[RodeoX]

I would guess you have some protection from this because it must be proven that you are the owner of the address.

Actually no, they will just charge you with the crime of not sharing your private key.

The police may suspect you are the crook, but they can't convict on that suspicion.

Maybe in TV and movies, but in real life it is very easy to convict an innocent person.

You need a better lawyer. It is not a crime to keep your private keys private. And you are not going to be convicted because you could have committed a crime. The prosecution must convince the court you did something. You do not have to prove that you are innocent.

[Harley997]

The police and LE would likely not use BTC addresses to track down theft of coins. They would probably use IP addresses and other traditional investigative tools.

Your scenario should make it overwhelmingly obvious that the person is being framed.