Georgetown Law
Technology Review

On November 2018, the White House announced renewed sanctions on the Iranian regime. The sanctions’ targets include fifty banks, the national airline, and 200 members of the shipping industry. While these sanctions predominately target large institutions, the Department of Treasury does have the ability to target individuals if national security so requires. Recently, the Department of Treasury sanctioned two Iran-based bitcoin traders, because the traders exchanged Iranian Rials[1] for bitcoin obtained by cyber-hackers. The cyber-hackers held a hospital network ransom and received the exchanged bitcoin to restore the hospital’s network. The Department of Treasury found the bitcoin wallet associated with the traders because the wallet was linked to their personal information. These traders facilitated over 7,000 bitcoin to Rial transactions prior to the cyber-hacker exchange.

These types of individual-to-individual transactions are much harder to regulate because they are decentralized from any sanctioned institutions, and the buyer may not even know who the seller is. Individuals can access the bitcoin network by creating an account that is not linked to any personal information and putting credit in that account, or “anonymous wallet,” to purchase bitcoin. Anonymous wallets can be created in minutes, and are very hard to trace. The two traders that were sanctioned suggested next time they would create an anonymous wallet to avoid such sanctions. This begs the question of how someone can regulate transactions if both the buyer and seller, as well as the U.S. Government, do not know who the other side of the transaction is, especially if it is a services related transaction that can be done purely online. The current sanctions programs all presume the U.S. Government can follow the money to investigate violations. This broken link in the money trail means that proper enforcement requires monitoring on both sides of the transaction.

To understand the current issue of enforcement, a brief survey of relevant sanctions is necessary to explore the various tools at the U.S. Government’s disposal. The U.S. Government has two basic categories of sanctions that encapsulate a multitude of statutes and regulations assembled to punish Iran and other bad actors around the world. Comprehensive sanctions ban transactions with an entire country, while targeted sanctions ban a specific conduct or particular actors. Through the Comprehensive Iran Sanctions, Accountability, and Divestment Act of 2010 (CISADA) and the Iran Sanctions Act of 1996 (ISA), the U.S. Government prohibits all imports and exports of goods and services indirectly or directly associated with Iran, with some exceptions. These two acts are some of the comprehensive sanctions on Iran. The reason these sanctions worked so well is because the U.S. can monitor both goods/services entering Iran and any money going to Iran or Iranian associated accounts. In addition, under the International Emergency Economic Powers Act (IEEPA), the President can enact executive orders (EO) during an “extraordinary threat” to block any transfer of “currency or securities.” This act allows the President to impose targeted sanctions on both individuals and transactions arising from certain conduct. Examples of targeted individual sanctions are EO 13,244, which allows the President to create a list of Specially Designated Persons to sanction, and EO 13,599 which froze all the property in the U.S. owned by the Government of Iran. Examples of targeted conduct sanctions are EO 13,382, which blocks all property contributing to weapons of mass destruction, and EO 13,494, which blocks property involved in cyberattacks. All these instruments presume that the U.S. Government can follow the money, but in the bitcoin world, one cannot even ascertain one side of the transaction, let alone track the money to see what the transaction is funding.

While there are few services available for purchase with bitcoin, there are some retailers that accept bitcoin who sell e-books, video games, movies, and other purely online goods or services that do not require a supply chain in Iran or a money trail. For example, an Iranian buyer with an anonymous wallet could buy an e-book on physics using bitcoin. Conversely, an Iranian seller could pose as a company offering tech support for bitcoin and the buyer would not know who the seller is. While the previously mentioned transactions would all technically be illegal, there is no means to enforce them. This danger requires us to rethink sanctions, especially as more retailers accept bitcoin for increasingly diverse online goods. Without the ability for the U.S. Government to track funds, the Iranian sanctions scheme will only be useful for a dwindling amount of traditional transactions. Therefore, individual transactions will need to be increasingly scrutinized as the prevalence of bitcoin rises and retailers may need to verify transactions with personal information checks.

[1] The Rial is the current currency of Iran.