Why does crypto work for Russian ransomware, but it wasn't useful for the Ottawa truckers?

[This is a repost of my recent article for CoinDesk exploring why bitcoin has been demonstratively useful for certain illegal activities, like ransomware, but fails when it comes to others, like the Ottawa trucker convoy. Spoiler: bitcoin's usefulness for engaging in non-permitted transactions very much depends on the onramping and offramping processes, and whether these threshold points are tightly controlled or not.] 

 The Ramps Killing Bitcoin's Dissident Thesis

 Crypto is marketed by its fans as an unstoppable dissident technology and feared by governments for its subversiveness. But the many shortcomings of a recent bitcoin fundraiser to support an illegal Ottawa, Ontario, trucker convoy (more on that later) suggests that crypto isn't as unstoppable or subversive as it is often made out to be.

But if Ottawa contradicts the standard crypto narrative, we also have an example that confirms it. Waves of successful Russian ransomware attacks relying on the Bitcoin network to extract ransom payments suggest that crypto is an incredibly effective technology for evading rules.

So which is it: unstoppable or not? The short answer: It depends on the off-ramps and on-ramps. Let's explore why crypto was a dud in Canada, but is highly successful for Russian ransomware operators.

What crypto brings to the table is the ability for two people to make a digital peer-to-peer transfer that cannot be preempted by a third party. But a peer-to-peer crypto transfer is only the middle step in a three-step circuit that begins with on-ramping into crypto and ends with off-ramping out of crypto. If either the on-ramping or the off-ramping processes are closed or guarded, much of crypto's fabled ability to circumvent restrictions is neutered.

The Ottawa trucker convoy bitcoin fundraiser is a good example of the off-ramping process being leveraged by law enforcement to defang crypto. I described the convoy’s financing last month for CoinDesk. Over the last few weeks various Canadian parliamentary committees and court rulings have shed more light on the fate of the convoy’s finances.

By early February, the convoy of truckers blockading downtown Ottawa had transitioned from legal protest to illegal mischief. Sending donations through centralized fiat-based crowdfunding sites became impossible. The convoy’s main fundraising campaign, hosted on GoFundMe, was shut down on Feb. 4. A pivot by convoy organizers to rival crowdfunding platform GiveSendGo [which is powered by Stripe] was rendered useless by an Ontario court's restraint order a few days later.

That left a bitcoin fundraiser by the name of HonkHonk Hodl as the only way to connect with the rogue blockaders.

The on-ramping stage of the convoy’s bitcoin fundraiser proceeded unimpeded. Any American who wanted to donate to the illegal blockade could freely swap U.S. dollars for bitcoin via an exchange such as Coinbase. Once the cryptocurrency was acquired, no force on earth could stop that bitcoin from being transferred from an American’s personal wallet across the border to the Canadian organizers' bitcoin address.

The bitcoin fundraiser eventually raised $1.1 million in bitcoin. It was at the final stage, off-ramping back into Canadian dollars, that things fell apart.

From the outset, the identities of the people in control of the convoy’s bitcoin wallets had been broadcast across social media. Once the convoy was deemed illegal mischief, these public-facing organizers and their wallet addresses became easy targets of police investigations, freezing orders, injunctions and class-action suits, all of which prevented them from off-ramping out of donated bitcoins into spendable fiat.

The strategy of publicizing the identities of the organizers might seem like a mistake, but it wasn’t. A fundraiser can't gain any momentum if the people collecting the money aren't identified. Anonymous organizers could very well be scammers, and the whiff of fraud would doom fundraising.

Nicholas St. Louis, the lead organizer of the bitcoin fundraiser and a suspect in a criminal investigation, was forced to give up seed phrases for his fundraising wallets to the Royal Canadian Mounted Police, which is Canada’s version of the FBI. Parallel to that, a separate civil court injunction on behalf of an Ottawa class-action suit named hundreds of bitcoin addresses associated with the fundraiser. To comply with the order, St. Louis eventually forfeited $250,000 in undistributed bitcoins to a court-appointed escrow agent. That sum will potentially be used to compensate Ottawa citizens damaged by the convoy's actions.

Just hours before the court injunction fell, St. Louis managed to distribute two-thirds of the donated bitcoins to around 100 truckers. To prove they were honestly distributed, St. Louis recorded himself giving envelopes to each trucker and published the recordings on social media. That made it a cinch for the RCMP, litigators and aggrieved Ottawa citizens to determine the identities of the truckers who received the donations.

The transparency of bitcoin’s blockchain means that all of the distributed bitcoin has been flagged by law enforcement as well as being listed in the court’s freezing order. Anti-money laundering officers at exchanges are on guard, and any effort on the part of the 100 truckers to off-ramp their cryptocurrencies into spendable currency by selling marked bitcoin on an exchange will result in forfeiture. Worse, the truckers could run into potential legal trouble if they try, because ignoring the court’s freezing order is punishable by fine or imprisonment.

Truckers brave enough to risk contravening the court order might try to evade exchange blacklists by directly buying goods and services with bitcoin. (They would have to use retailers that don’t rely on compliant crypto payments processors like BitPay.) Given that bitcoin is so rarely accepted in trade, this is tantamount to barter, and bartering is inconvenient.

So the truckers have been left holding a bunch of mostly useless, even dangerous, injuncted crypto. As for the remaining undistributed donations, they have all been confiscated by the courts. What a mess.

If bitcoin failed the truckers, let's see why it has worked so well for ransomware operators. Ransomware is malicious software that takes control of a computer by encrypting files or threatening to publicly expose data. The ransomware operator, typically located in Russia, releases that control only after receiving a ransom payment, usually bitcoin. In one of the more notorious incidents, JBS USA, the world’s largest meat supplier, paid an $11 million bitcoin ransom to free its computers.

The ransom payment on-ramping process is completely fluid. That is, it is 100% legal for the U.S. victim of a ransomware attack – usually a corporation such as JBS, a school board or a government agency – to buy bitcoin on an exchange like Coinbase in order to pay the ransom. In fact, a new industry known as ransomware payments facilitation has emerged to service this need.

Whereas a wire payment to a Russian bank account might be frozen or clawed back, a bitcoin payment made to a Russian ransomware operator's wallet can't be. That's tremendously useful to ransomware operators.

Most importantly, Russian officials have made little attempt to inhibit the off-ramping process. As long as ransomware gangs don’t attack Russian companies, their ability to operate on Russian soil has been tolerated as has their access to Russian off-ramps. For instance, nested exchanges with Russian links such as Suex and Chatex have been used by Ryuk and Conti ransomware operators to convert bitcoin ransoms into useful currency.

And that's why ransomware has been so successful. The combination of 1) unimpeded U.S. on-ramping 2) a US-to-Russia bitcoin bridge and 3) unimpeded Russian off-ramping creates an unstoppable monetary circuit. By contrast, Canadians' closure of the off-ramping process crippled the convoy's bitcoin fundraising circuit.

(Incidentally, this is why one of the quickest ways to end the ransomware threat is to shut off the on-ramps: Make it illegal for U.S. entities to pay crypto ransoms. It also illustrates why Russians can’t rely on crypto to evade sanctions: the big off-ramps like Binance and Bitfinex can be controlled by U.S. sanctions policy.)

Governments, whether they be democracies or dictatorships, are often fearful of crypto's censorship-resistance, leading to calls for bans. The lesson from the Ottawa trucker convoy and Russian ransomware gangs is that as long as the on-ramping and off-ramping process are regulated, these fears are overblown.

As for advocates of bitcoin’s capacity to help dissidents, if the trucker convoy proves anything, it’s that these advocates have their work cut out for them.

Stripe and the Ottawa trucker convoy

Why did Stripe, a global payments giant, decide to help the Ottawa trucker convoy? That's what I was wondering as I watched the recent House of Commons committee into the crowdfunding of the convoy, which aired last week. (You can catch it here.) 

If you recall, the convoy raised $10 million or so via GoFundMe, a crowdfunding site, only to switch over to competitor GiveSendGo on February 5 when GoFundMe froze its campaign. (I wrote about convoy financing here and here.) The $9 million or so that was subsequently raised on GiveSendGo was to be disbursed to truckers to pay for fuel, food, and shelter. These funds are currently frozen thanks to an Ontario government restraint order and a private class action suit's Mareva injunction.

The committee's inquiry makes for interesting listening. Representatives of Stripe, PayPal, and GoFundMe were questioned during the first hour. The second hour was taken up by GiveSendGo's two founders.

Stripe's role in all of this seems the most questionable to me, and credit goes to Members of Parliament Demoff, MacGregor, and Chiang for trying to tease out Stripe's line of thinking. Why did Stripe, one of the largest payments facilitators in the world, keep connecting GiveSendGo's convoy fundraiser long after it was clearly illegal under Canadian law?

Stripe is a payments processor. It provides online stores and websites with access to the all-important Visa and MasterCard payments networks. During the committee meeting, we learnt that Stripe is the payments processor for both GoFundMe and GiveSendGo. Crowdfunding sites like GoFundMe and GiveSendGo provide a set of tools that campaigners who need funds can use to connect to donors.

GoFundMe shut down the convoy's campaign on February 5 citing violations of its terms of service, specifically a prohibition on violence. In the first hour of the Parliamentary committee meeting, we learnt that GoFundMe based its decision on direct communication with Ottawa's mayor and its police chief.

It's important to realize that the terms of service for GoFundMe, GiveSendGo, and Stripe are broadly similar. They all prohibit transactions that will be used to promote violence. Neither GiveSendGo nor GoFundMe allow campaigns that promote hate. (Notably, Stripe doesn't say anything about hate in its terms of service.) Lastly, all three prohibit their platforms from being used for illegal activities.

GiveSendGo's convoy campaign came online on February 5, almost to the hour that GoFundMe closed down the convoy's original fundraiser. If you haven't heard of GiveSendGo, think of it as the Rebel News of crowdfunding sites. In addition to trumpeting its Christian virtues, GiveSendGo loudly & proudly reconnects any controversial campaign that GoFundMe has cut off, the idea being to exploit America's culture wars in order to gain traction against its crowdfunding competitor. For instance, after GoFundMe halted campaigns such as Kyle Rittenhouse's legal fundraiser and a number of anti-vaccine efforts, GiveSendGo reconnected them. (See my article for the Sound Money Project on this.)

(And that's fine, by the way. As long as people on all sides of the political spectrum are engaged in legal non-violent activities, they should get access to the payments oligopolies Visa and MasterCard. The combative competition between GoFundMe and GiveSendGo achieves that.)

So now you can understand why GiveSendGo would crave a controversial (even illegal) campaign like the trucker convoy. What a perfect marketing stunt for catching the attention of its broadly American user base. But Stripe's reasoning for welcoming the convoy is less clear. Stripe is not a small-time redneck organization mining the culture wars for attention. It's a big multinational payments processor.

Let's try and tease out the legal ambiguities that Stripe must have struggled with beginning on February 5. After conversations with Ottawa's police chief, Stripe's own customer GoFundMe had just cut the convoy off on alleged violence. Yet that very same day Stripe chose to allow the convoy-linked funds to flow across its platform via its other customer, GiveSendGo, even though Stripe's terms of service prohibits violence.

Did Stripe not agree with GoFundMe's assessment that the funds were facilitating violent activity? Perhaps it had better information sources than Ottawa's police chief?  

Maybe Stripe execs decided to treat violence as one of those things that's open to interpretation. A few incidents can be written off as bad apples, leaving the overall campaign in compliance. The just a few bad apples defence seems to have been GiveSendGo's justification. In his account to the House of Commons committee, GiveSendGo co-founder Jacob Wells rationalized hosting the trucker campaign by noting that there are always "fringe elements" in any protest. Perhaps Stripe execs felt the same?

Or was Stripe's decision to connect the convoy fundraiser a case of willful ignorance? That is, was it a case of avoiding becoming too informed about the situation in order to dodge having to make a difficult decision? Unlike GoFundMe, Stripe never seems to have reached out to Ottawa's police chief. And Ottawa's police chief never directly contacted Stripe. Might this combination have allowed Stripe to maintain enough distance that it could determine that the convoy was in compliance with its terms of service?

A version of willful ignorance was cited by GiveSendGo. “We were doing our business, allowing people to raise funds on GiveSendGo. Your government found issue with it, but yet they would not come to us and tell us they found issues," said co-founder Heather Wilson. "The Bible speaks to this, that when you have an issue with somebody you go talk to them and you resolve it." Like GiveSendGo, maybe Stripe deemed the lack of an explicit nudge from Canadian law enforcement to be sufficient to clear the convoy of suspicions of violence.

Let's move on. Violence is one thing, but the bigger issue to me is plain ol' illegality. If violence is open to interpretation, surely illegality is a black and white issue.

As MP MacGregor pointed out in his line of questioning, on February 6 the City of Ottawa had declared a state of emergency. But Stripe continued to process payments for the convoy. Here is MacGregor: "I think we all have a question here. How did Stripe allow this to go so far? Were you not aware of what was happening with these funds?" 

On February 9, the Ottawa police department notified protestors they were engaging in mischief, a criminal offense. The "unlawful blocking" of streets was resulting in citizens being denied the "lawful use, enjoyment and operation of their property," declared the police department's press release, and the convoy was henceforth required to cease its blockade of downtown Ottawa.

Even though the crime of mischief had been publicly cited by the police, Stripe continued to allow the GiveSendGo fundraiser to accept payments. 

Remember, Stripe says that it prohibits illegality. In Stripe's words, you must not use Stripe’s services for "products or services that are in violation of law in the jurisdictions where your business is located or targeted to." So the convoy was in violation of Canadian law, yet Stripe kept the funds flowing.

The illegal nature of the protest only got more explicit with the passage of time. On February 10, an Ontario Superior Court justice signed a restraint order freezing the GiveSendGo funds based on a police affidavit that the funds were facilitating the "indictable offence of mischief."

Surely this was the smoking gun.

Not so. With one hand Stripe froze the funds. That is, it complied with the restraint order by refusing to disburse the funds to the convoy. With the other hand it continued to allow the campaign to raise money. Yep, donors could still use their cards to fund a GiveSendGo campaign that was, by that time, plainly illegal under Canadian law. (The campaign remains open to this day.)

The parliamentary committee meeting never fully explored Stripe's thought process. But if I had an hour with Stripe executives, I'd want them to explain how they squared: 1) GoFundMe's finding of violence with Stripe's own prohibition on violence, and 2) law enforcement's description of the convoy as illegal with Stripe's prohibition against illegal activity. Stripe may very well have a sound legal basis for why they let the convoy fundraiser go on. (Perhaps it would have exposed it to liability in the U.S.?)

Or maybe this was a case of a platform enforcing its prohibition against violence and illegality as loosely as possible (or not at all) in order to continue a profitable relationship. I'd like to know more.

The trucker convoy and "choking off" their funding

Look, I don't support the so-called "Freedom Convoy." Of the two big demonstrations currently going on in Canada – the Freedom Convoy and the Fairy Creek protests  – I'd pick the Fairy Creek protestors (who want to stop logging of old-growth trees in B.C.).

But I think some critics are going too far in calling for a "choking off" of the money that finances the convoy, as Mark Carney recently did. Carney went on to describe anyone sending money to the convoy as "funding sedition" and wants to "identify and thoroughly punish" the convoy's foreign funders. Meanwhile, Jagmeet Singh's NDP Party has launched a petition calling on the government to contact Joe Biden and "shut down funding coming from the US".

What Carney and Singh have in mind is probably the convoy's massive crowdfunding campaign. Initially launched on U.S.-based GoFundMe, the campaign was frozen last week citing police reports that the demonstration had become an "occupation". The convoy has since switched to a so-called "Christian" crowdfunding site called GiveSendGo. Funds raised via GiveSendGo now clock in at almost $8 million. Presumably Carney and Singh want this $8 million stopped.

I agree with the majority of Canadians (65%, according to Leger) who see the convoy as representing a "small selfish minority." This minority want to lever Canadians' Covid fatigue into a funnel for importing toxic Trumpism into Canada. 

However, Canadians have a right to protest. Any demonstration, whether it be Fairy Creek or the Ottawa trucker convoy, is inevitably going to involve some degree of disruption to the regular flow of life. That's how protestors attract attention and change minds. Protesters often need money, especially well-organized protestors. And crowdfunding sites, both domestic and foreign, offer them the ability to connect with donors.

We have rules about how far this disruption can go. Once this point is reached, an Ontario court will issue an injunction ordering an end to the protest, at which point the convoy must disband. Those who continue to gather are doing so illegally and can be arrested.

As far as I know, the Freedom Convoy has not been declared illegal by a judge. And so GiveSendGo is probably in its rights to host a fundraiser for the convoy. Until the protest has definitively crossed the line into illegal territory, talk of "choking off" funds is premature, indeed irresponsible – it amounts to calling for the state to censor Canadians' ability to protest.

Nor does the fact that Americans are major contributors to the convoy justify a government-led choking-off of funding. The proper trigger for freezing funding isn't the nationality of a protest's financial contributors. The proper trigger is when the court deems the protest illegal, and whether law enforcement believes that its enforcement strategy requires a blocking of funds.

By the way, these same principles would apply if the Conservative Party's Andrew Scheer had called for a choking-off of funds to the Fairy Creek protestors. As long as Fairy Creek protest is legal (more on that later) the funds should be allowed to flow freely, even if lefty Americans are donating.

In the next few days things could get interesting. Imagine an Ontario court issues an injunction ordering the protest to end... but the protesters do not leave. The police begin to enforce the injunction by  removing illegal protestors, but the whole thing explodes into a riot. At this point one would expect GiveSendGo to pull the plug on the $8 million campaign. According to its own terms of service, GiveSendGo doesn't allow campaigns that "violate any law, statute, ordinance or regulation."

Spurned on by wingnuts on the American right, GiveSendGo could very well choose to ignore its own terms of service. Let's say that it keeps on hosting the convoy's now-illegal campaign. 

Is Canada helpless to stop the funds raised on a U.S. based platform from reaching the illegal protestors? Jagmeet Singh seems to think so, suggesting that we must contact the US administration to shut down funding.

Relax. Canada already has all the tools necessary to uphold the law. Before the funds can be spent by the convoy, GiveSendGo will have to wire the $8 million from its U.S. bank account to the Canadian bank account of Freedom 2022 Human Rights and Freedoms, the non-profit representing the protestors. Law enforcement can ask the non-profit's bank – maybe Royal Bank or CIBC – to freeze the convoy's account, should it deem this step necessary. Problem solved.

Incidentally, the Fairy Creek protestors in B.C. continue to raise funds on the Fundrazr crowdfunding platform. (Like the trucker convoy, GoFundMe froze Fairy Creek's first campaign, forcing it to pivot to an alternative platform.) The Fairy Creek protester's Fundrazr campaign hasn't been halted despite B.C. courts having issued and renewed an injunction restraining "unlawful interference by protesters," and Fundrazr's terms of service prohibiting the violation of "any applicable local, province, state, national or international law."

It could be that the Fairy Creek campaign's lawyers are being very careful about how they spend the funds. Or maybe the police's enforcement strategy doesn't yet extend to freezing the protester's funding sources.

But ultimately, sustaining the rule of law is vital (as Brian Lee Crowley so ably describes here). If putting a halt to illegal activities requires the extreme step of removing funding supporting those activities, then that's a justifiable step to take, whether that be the dollars raised by the Freedom Convoy or the protesters at Fairy Creek.

---

PS: A few hours after I posted this the Ontario government successfully petitioned the Superior Court to freeze the convoy's GiveSendGo funds based on the allegation that it is "offence-related property." Here are the relevant sections of the code. Unfortunately the government has given no indication of what the offence is.