The Privacy Limits of Transacting in Bitcoin: The Fifth Circuit’s Flawed Reasoning in United States v. Gratkowski

Yana Kogan

 

Privacy has been central to Bitcoin since its inception.[1] Bitcoin was expressly created to be a peer-to-peer form of digital cash[2] and retain privacy through the anonymity of public keys.[3] The decentralized nature of cryptocurrency presents novel legal issues for courts to consider, specifically those related to Fourth Amendment privacy rights.[4] Thus far, several courts have found that individuals who transact in Bitcoin through a third-party exchange platform, such as Coinbase, do not have a privacy interest in their personal information. [5] However, the Fifth Circuit, in its Gratkowski decision, was the first to find that an individual does not have a privacy interest in their personal information located directly on the blockchain.[6]

 

United States v. Gratkowski

In a recent case looking at the interplay of cryptocurrency and Fourth Amendment privacy rights, the Fifth Circuit addressed the novel issue of “whether an individual has a Fourth Amendment privacy interest in the records of their Bitcoin transactions.”[7] The court held that (1) the defendant lacked a privacy interest in his personal information located on Coinbase, a cryptocurrency exchange platform,[8] and (2) the defendant lacked a privacy interest in his information located directly on the blockchain.[9]

 

While investigating a child pornography site, federal agents discovered that some users were paying the site in Bitcoin to download material.[10] The federal agents analyzed the Bitcoin blockchain and identified the site’s Bitcoin addresses (unique identifiers similar to a bank account number). [11] The agents proceeded to subpoena Coinbase for all information on the users who had sent Bitcoin to the site’s addresses.[12] The information Coinbase provided led to a search warrant for Gratkowski’s house, which ultimately led to his confession and arrest once federal agents found a hard drive containing child pornography in his home.[13]

 

Gratkowski moved to suppress the evidence found through the search warrant, arguing that the subpoena to Coinbase and the blockchain analysis violated his Fourth Amendment right to privacy.[14] The district court denied the motion and Gratkowski appealed.[15]

 

Ultimately, the Fifth Circuit rejected Gratkowski’s appeal and held that he did not have a privacy interest in his personal information located on Coinbase or the Bitcoin blockchain.[16] Notably, the court was the first to find that an individual does not have a privacy interest, nor a reasonable expectation of privacy, in their personal information on the blockchain directly.[17]  

 

Flawed Reasoning in Gratkowski

In finding that Gratkowski lacked a privacy interest in his Coinbase records, the Fifth Circuit reasoned that there is a tradeoff when an individual decides to use a third-party intermediary: the individual gives up privacy—privacy they would otherwise have if they transacted on Bitcoin’s blockchain directly—for the ease of using a third-party exchange platform like Coinbase.[18] Notwithstanding this reasoning, the court still found no privacy interest in the information located directly on the blockchain, which exists when an individual uses no third-party intermediary.[19] These two findings are arguably inconsistent with each other.

 

On the one hand, the court reasons that “Bitcoin users have the option to maintain a high level of privacy by transacting without a third-party intermediary.”[20] On the other, the court reasons that individuals do not have a legitimate expectation of privacy in their information located directly on the blockchain.[21] This unexplained distinction—that an individual may sacrifice convenience to maintain a “high level of privacy” while simultaneously lacking an expectation of privacy—demonstrates the court’s inconsistency in its Gratkowski opinion.[22]

 

Moreover, the Court argues that “Bitcoin users are unlikely to expect that the information published on the Bitcoin blockchain will be kept private…[as] it is well known that each Bitcoin transaction is recorded in a publicly available blockchain.”[23] While it is true that Bitcoin transactions are publicly announced,^[24] this statement demonstrates the court’s misunderstanding of Bitcoin’s public-disclosure protocol. The court’s argument is based on the faulty notion that since the Bitcoin blockchain is public, users are unlikely to expect that their information will be kept private. However, the reason the Bitcoin blockchain is public refutes the court’s reasoning.

 

Bitcoin transactions are publicly announced to maintain trust, privacy, and decentralization simultaneously. Bitcoin was created with the goal of establishing a peer-to-peer version of electronic cash, which would allow money to be transferred in a decentralized fashion, as in, without a financial institution.[25] The distributed and transparent nature of Bitcoin prevents double-spending and, thus, preserves trust between transacting parties.[26] This is because the only way to confirm that digital cash has not already been spent, without a trusted third-party, “is to be aware of all transactions.”[27]

 

As for privacy, Bitcoin’s cryptographic key system retains anonymity for its users: the public key, also known as the Bitcoin address, is kept anonymous so that it cannot be used to identify the user.[28] Anyone viewing the Bitcoin blockchain “can see that someone is sending an amount to someone else, but without information linking the transaction to anyone.”[29] Therefore, the Court’s reasoning is flawed, since it assumes that public announcements make transactions less private, whereas Bitcoin’s public-private key system preserves anonymity for the transacting parties.[30]

 

Conclusion

The Fifth Circuit’s flawed reasoning portrays the court’s misunderstanding of Bitcoin and its users. First, the court reasons that Coinbase users are unlikely to have a reasonable expectation of privacy, since they are sacrificing some privacy for the convenience of using a third-party intermediary. This reasoning is not consistent with the Fifth Circuit’s holding that Gratkowski lacked a privacy interest in his information located on the blockchain itself. Second, the court’s statement that Bitcoin users likely do not have a legitimate expectation of privacy[31] is based on the flawed assumption that because the Bitcoin blockchain is public, users are unlikely to expect that their information will be kept private. On the contrary, Bitcoin users likely expect their information to be kept private, as the keys and Bitcoin addresses are kept anonymous.[32]

 

The Fifth Circuit was the first to address the issue of privacy interests in transactions made directly on the blockchain, without a third-party intermediary. Whether other courts will agree with the Fifth Circuit’s holding remains to be seen.

 

---------------------------------------------------

[1] Satoshi Nakamoto, Bitcoin: A Peer-to-Peer Electronic Cash System, https://bitcoin.org/bitcoin.pdf (containing an entire section dedicated to privacy).

[2] Id. at 1, https://bitcoin.org/bitcoin.pdf (describing how a peer-to-peer network eliminates the need for trusted third parties such as banks and financial institutions).

[3] Id. at 6 (retaining privacy without a trusted third party by “keeping public keys anonymous”).

[4] See Paul Belonick, Transparency is the New Privacy: Blockchain’s Challenge for the Fourth Amendment, 23 Stan. Tech. L. Rev. 114 (2020) (arguing that the current Fourth Amendment doctrine rests “on physical-world analogies that do not hold in blockchain’s unique digital space”); Lawrence J. Trautman, Bitcoin, Virtual Currencies, and the Struggle of Law and Regulation to Keep Pace, 102 Marq. L. Rev. 447 (2018) (describing the struggle for law and regulation to keep pace with emerging blockchain and cryptocurrency technology).

[5] See United States v. Gratkowski, 964 F.3d 307, 310 (5th Cir. 2020) (finding that the defendant lacked a privacy interest in his personal information on Coinbase, a cryptocurrency exchange platform). Prior to this decision, two other federal district courts addressed the issue of whether an individual has a reasonable expectation of privacy in their personal information located on a cryptocurrency exchange. See Zietzke v. United States (Zietzke II), No. 19-cv-03761, 2020 WL 264394 (N.D. Cal. Jan. 17, 2020); see also Zietzke v. United States (Zietzke I), 426 F. Supp. 3d 758 (W.D. Wash. 2019). Both district courts found that the defendants did not have a privacy interest in their transaction records because the transactions were made through a third-party intermediary. Zietzke II, 2020 WL 264394, at *13; Zietzke I, 426 F. Supp. 3d at 768–69.

[6] See Gratkowski, 964 F.3d 307 at 312.

[7] Id. at 310

[8] Id. at 313. Bitcoin users have the option of transacting via crypto-currency exchange platforms, such as Coinbase. However, Bitcoin was created to be a peer-to-peer form of digital cash. See Nakamoto, supra note 1, at 2. Using a third-party (i.e., Coinbase) negates the goal of Bitcoin, as users using Coinbase are still relying on a third-party to store their digital cash. What is Coinbase?, Coinbase, https://help.coinbase.com/en/coinbase/getting-started/crypto-education/what-is-coinbase. However, it is known to be more convenient and easier than creating your own digital wallet.

[9] Gratkowski, 964 F.3d 307 at 312. Blockchain is an immutable, distributed ledger that allows users to timestamp, record, and track transactions. See Michael Nofer, et. al., Blockchain, 59 Bus. Info. Sys. Eng’g. 183, 183-84 (2017) (“A blockchain consists of data sets which are composed of a chain of data packages (blocks) where a block comprises multiple transactions. The blockchain is extended by each additional block and hence represents a complete ledger of the transaction history. Blocks can be validated by the network using cryptographic means.”).

[10] Gratkowski, 964 F.3d 307 at 309.

[11] Id.

[12] Id.

[13] Id.

[14] Id. at 310 (“Under the third-party doctrine, a person generally ‘has no legitimate expectation of privacy in information he voluntarily turns over to third parties.’ Smith v. Maryland, 442 U.S. 735, 743–44 (1979). But relying on Carpenter v. United States, 138 S. Ct. 2206, 2217 (2018), which limited the applicability of the third-party doctrine in the context of cell phones, Gratkowski argues that the Government violated his reasonable expectation of privacy in the records of his Bitcoin transactions on (1) Bitcoin’s public blockchain and (2) Coinbase. In that regard, Gratkowski argues that the district court erred in denying his suppression motion.”); Carpenter, 138 S. Ct. 2206 at 2217.

[15] Gratkowski, 964 F.3d 307 at 310.

[16] Id. at 310, 312.

[17] Id. at 312–13 (“For the Government to have infringed upon an individual’s Fourth Amendment protection against unreasonable searches, the person must have had a ‘reasonable expectation of privacy’ in the items at issue. United States v. Jones, 565 U.S. 400, 406 (2012).”).

[18] Gratkowski, 964 F.3d 307 at 312-13 (“Bitcoin users have the option to maintain a high level of privacy by transacting without a third-party intermediary. But that requires technical expertise, so Bitcoin users may elect to sacrifice some privacy by transacting through an intermediary such as Coinbase. Gratkowski thus lacked a privacy interest in the records of his Bitcoin transactions on Coinbase.”).

[19] Id.

[20] Id. (emphasis added).

[21] See Gratkowski, 964 F.3d 307 at 312 (“Bitcoin users are unlikely to expect that the information published on the Bitcoin blockchain will be kept private, thus undercutting their claim of a ‘legitimate expectation of privacy.’ See Smith, 442 U.S. at 743”).

[22] Gratkowski, 964 F.3d 307 at 312

[23] Id. at 312-13.

[24] Nakamoto, supra note 1, at 2

[25] Id. at 1.

[26] See Nofer, supra note 9, at 184 (“Using cryptography, people all over the world can trust each other and transfer different kinds of assets peer-to-peer over the internet. [Bitcoin’s] distributed ledger increases trust since people do not have to assess the trustworthiness of the intermediary or other participants in the network”).

[27] Nakamoto, supra note 1, at 2 (“We need a way for the payee to know that the previous owners did not sign any earlier transactions. For our purposes, the earliest transaction is the one that counts, so we don't care about later attempts to double-spend. The only way to confirm the absence of a transaction is to be aware of all transactions”).

[28] Id.; See Belonick, supra note 4, at 126 (Bitcoin’s system “uses two keys: a public key that can be shared with others with whom one wishes to interact, and a secret private key known only to an individual user. The two keys are created and linked by a mathematical algorithm, and the public key scrambles data, while only the private key can unscramble the data”).

[29] See Jonathan Lane, Bitcoin, Silk Road, and the Need for a New Approach to Virtual Currency Regulation, 8 Charleston L. Rev. 511 (2014) (“The software generates two mathematically related keys, one public and one private, that together make up a user's digital signature. The public key, also known as the Bitcoin address, is used to send and accept payments to and from other users, while the private key remains concealed with the user and functions as a password to unlock the transaction. For each public key, or Bitcoin address, there is exactly one matching private key that is mathematically related to it and is designed in a way that the public key may be calculated from it, but not vice-versa”) (footnotes omitted).

[30] See supra note 27 and accompanying text.

[31] See Gratkowski, 964 F.3d 307 at 312 (“Bitcoin users are unlikely to expect that the information published on the Bitcoin blockchain will be kept private, thus undercutting their claim of a ‘legitimate expectation of privacy.’ See Smith, 442 U.S. at 743”).

[32] See Nakamoto, supra note 1, at 6; see also Protect your privacy, Bitcoin Project, https://bitcoin.org/en/protect-your-privacy (dedicating a page to help users protect their privacy with recommendations such as: using a new Bitcoin address for every new payment; making sure not to disclose Bitcoin addresses; and being careful with public spaces generally).