Prosecuting Privacy Won’t Stop Crypto Crime -By Fransiscus Nanga Roka

The United States could turn its battle against illegal financial activity into a prosecution of what is technically possible. Roman Storm’s case requires that there be responsibility for proven criminal actions and that there be a clear line drawn to prevent guilt based upon an individual’s association with software.

In August of 2025, a Manhattan jury found one of the co-founders of Tornado Cash guilty of conspiring to operate an illegal money transmitter business. However, the same jury was unable to reach a verdict regarding whether or not he should be found guilty of money laundering or conspiracy to violate federal sanctions. As such, the latter two charges continue to be just that – charges – and have not resulted in a conviction. Reports indicate that his new trial will take place on April 26th of 2027.

As of October of this year, federal prosecutors used the D.C. Circuit’s ruling on Bitcoin Fog, made public in September of this year, to argue against Storm being acquitted. The D.C. Circuit upheld both Roman Sterlingov’s conviction and 150-month prison term. Prosecutors claim that the D.C. Circuit’s venue reasoning provides support for prosecuting Storm in New York City based upon the fact that a user conducted business using Tornado Cash while located in Manhattan.

But borrowing a precedent cannot substitute for proving a defendant’s conduct.

First, the choice of venue defines where the prosecution will take place, but does not define whether or not there was criminal intent. Therefore, a customer’s location alone does not provide sufficient evidence that a developer participated in a money laundering conspiracy. Additionally, although a decision of the U.S. Court of Appeals for the District of Columbia Circuit serves as persuasive authority for the Southern District of New York (Manhattan), it is not a binding precedent.

Second, how you use technology matters. There is a big difference between being an individual user of a centralized mixing service and developing an automated, decentralized software application. Each of these activities involves different levels of control, intervention, and responsibility. It is important to remember that neither “decentralized” nor “open source” allows for immunity. On the other hand, neither label will permit a prosecutor to ignore the amount of control a defendant had over his/her actions.

The Government’s case should receive careful analysis since they are making allegations beyond publishing code. The Department of Justice is claiming that Storm was providing critical infrastructure, promoting the service, profiting from the service, and continued to operate after he knew that money was coming from illegal activities. It is important to compare these claims to the available evidence as well as the components of the various charges being brought forward.

Policy tensions became more pronounced on October 6th with the withdrawal of FinCEN’s proposed rule on reporting of mixer transactions. In its public notice, FinCEN stated that it was aware of the concern that the broad definition of mixers would inhibit lawful use of mixers and cause excessive reporting requirements. FinCEN further recognized that mixers can be used lawfully to enhance personal financial privacy.

The fact that the withdrawal has occurred does not invalidate criminal laws nor does it clear Storm. However, Washington is required to provide developers with a clear definition of where development ends and participation in criminal activity begins. It is possible for regulatory restrictions to exist along side criminal enforcement; however, when developers do not understand how these boundaries will be applied, they may face arbitrary enforcement.

Three reforms are urgent.

Congress must clearly define the money transmission obligation of noncustodial systems in a prospective manner. The rules need to differentiate between publishing software and conducting business, as well as define how control, conduct and mental states affect liability.

The courts ought to demand specific proof of each charge regarding both the defendant’s intention to commit the crime and his/her agreement to do so. In addition to demanding charge-specific proof of intent and agreement, the court should also analyze the question of venue as a separate issue. Finally, if the court allows into evidence the results of tracing transactions using blockchain technology, then it must allow the defendant to challege the reliability of such evidence. The general knowledge that some criminals are misusing certain types of technology does not allow the courts to silently substitute for the required elements of the crimes which Congress has defined.

The DOJ and the Treasury Department should release jointly issued guidance that provides protection for research conducted in good faith and the publication of software, while still allowing for the prosecution of those who knowingly facilitate criminal activity. In addition to releasing such guidance, policymakers should provide funding for research into privacy-protecting methods for complying with regulations, as opposed to assuming that the only feasible method for ensuring compliance is to monitor every single financial transaction.

The victims of computer hacking should be compensated and their rights enforced effectively. Developers also need to have proper notification. Neither of these interests can be satisfied if you treat privacy as evidence of wrongdoing.

In the event that prosecutors are able to show that Storm had knowledge of his/her involvement in the conspiracy charges, software should not provide an opportunity for him/her to avoid being held accountable. Conversely, if the government is unable to establish this connection, then we cannot allow a perceived threat of criminal activity involving cryptocurrency to serve as a substitute for proof.

Fransiscus Nanga Roka

Faculty of Law University 17 August 1945 Surabaya and Managing Partner Law Firm Victorious Indonesia