The Cryptocurrency Surveillance Provision Buried in the Infrastructure Bill is a Disaster for Digital Privacy

The forthcoming Senate draft of Biden’s infrastructure bill—a 2,000+ page bill designed to update the United States’ roads, highways, and digital infrastructure—contains a poorly crafted provision that could create new surveillance requirements for many within the blockchain ecosystem. This could include developers and others who do not control digital assets on behalf of users.

While the language is still evolving, the proposal would seek to expand the definition of “broker” under section 6045(c)(1) of the Internal Revenue Code of 1986 to include anyone who is “responsible for and regularly providing any service effectuating transfers of digital assets” on behalf of another person. These newly defined brokers would be required to comply with IRS reporting requirements for brokers, including filing form 1099s with the IRS. That means they would have to collect user data, including users’ names and addresses.

The broad, confusing language leaves open a door for almost any entity within the cryptocurrency ecosystem to be considered a “broker”—including software developers and cryptocurrency startups that aren’t custodying or controlling assets on behalf of their users. It could even potentially implicate miners, those who confirm and verify blockchain transactions. The mandate to collect names, addresses, and transactions of customers means almost every company even tangentially related to cryptocurrency may suddenly be forced to surveil their users. 

How this would work in practice is still very much an open question. Indeed, perhaps this extremely broad interpretation was not even the intent of the drafters of this language. But given the rapid timeline for the bill’s likely passage, those answers may not be resolved before it hits the Senate floor for a vote.

Some may wonder why an infrastructure bill primarily focused on topics like highways is even attempting to address as complex and evolving a topic as digital privacy and cryptocurrency. This provision is actually buried in the section of the bill relevant to covering the costs of the other proposals. In general, bills that seek to offer new government services must explain how the government will pay for those services. This can be done through increasing taxes or by somehow improving tax compliance. The cryptocurrency provision in this bill is attempting to do the latter. The argument is that by engaging in more rigorous surveillance of the cryptocurrency community, the Biden administration will see more tax revenue flow in from this community without actually increasing taxes, and thus be able to cover $28 billion of its $2 trillion infrastructure plan. Basically, it’s presuming that huge swaths of cryptocurrency users are engaged in mass tax avoidance, without providing any evidence of that.

Make no mistake: there is a clear and substantial harm in ratcheting up financial surveillance and forcing more actors within the blockchain ecosystem to gather data on users. Including this provision in the infrastructure bill will: 

• Require new surveillance of everyday users of cryptocurrency;
• Force software creators and others who do not custody cryptocurrency for their users to implement cumbersome surveillance systems or stop offering services in the United States;
• Create more honeypots of private information about cryptocurrency users that could attract malicious actors; and
• Create more legal complexity to developing blockchain projects or verifying transactions in the United States—likely leading to more innovation moving overseas.

Furthermore, it is impossible for miners and developers to comply with these reporting requirements; these parties have no way to gather that type of information. 

The bill could also create uncertainty about the ability to conduct cryptocurrency transactions directly with others, via open source code (e.g. smart contracts and decentralized exchanges), while remaining anonymous. The ability to transact directly with others anonymously is fundamental to civil liberties, as financial records provide an intimate window into a person’s life.

This poor drafting appears to be yet another example of lawmakers failing to understand the underlying technology used by cryptocurrencies. EFF has long advocated for Congress to protect consumers by focusing on malicious actors engaged in fraudulent practices within the cryptocurrency space. However, overbroad and technologically disconnected cryptocurrency regulation could do more harm than good. Blockchain projects should serve the interests and needs of users, and we hope to see a diverse and competitive ecosystem where values such as individual privacy, censorship-resistance, and interoperability are designed into blockchain projects from the ground up. Smart cryptocurrency regulation will foster this innovation and uphold consumer privacy, not surveil users while failing to do anything meaningful to combat fraud.

EFF has a few key concepts we’ve urged Congress to adopt when developing cryptocurrency regulation, specifically that any regulation:

• Should be technologically neutral;
• Should not apply to those who merely write and publish code;
• Should provide protections for individual miners, merchants who accept cryptocurrencies, and individuals who trade in cryptocurrency as consumers;
• Should focus on custodial services that hold and trade assets on behalf of users;
• Should provide an adequate on-ramp for new services to comply;
• Should recognize the human right to privacy;
• Should recognize the important role of decentralized technologies in empowering consumers;
• Should not chill future innovation that will benefit consumers.

The poorly drafted provision in Biden’s infrastructure bill fails our criteria across the board.

The Senate should act swiftly to modify or remove this dangerous provision. Getting cryptocurrency regulation right means ensuring an opportunity for public engagement and nuance—and the breakneck timeline of the infrastructure bill leaves no chance for either.