Blockchain and the Law is one of the first books offering a high-level overview of the legal issues raised by blockchain technology, although it is an overview in breadth more than in depth. The book provides a well-written and useful introduction to the subject for readers unfamiliar with the technology and its legal and policy implications. Those seeking a technical and in-depth legal analysis of blockchain technology, however, will need to look elsewhere.
De Filippi and Wright are well positioned to undertake the challenging task of explaining the legal issues raised by blockchain in lay terms, having researched the topic from much before the bitcoin boom and blockchain hype. The drawback is that the book focuses on the type of blockchains that were most prevalent in the earlier days of the technology (the public, permissionless bitcoin and ethereum blockchains), at the expense of the private, permissioned blockchains that have been an important driver of blockchain activity more recently.
The book starts with an accessible description of how blockchain technology works. Chapters 1 and 2 describe the technology's core characteristics, such as public-private key cryptography and consensus mechanisms, and explain how it fits into the existing Internet infrastructure. Readers with a general understanding of the technology might have wished that a book on blockchain and law would devote a larger number of pages to the legal analysis of the technology. It takes roughly 60 (out of 210) pages of introductory explanation of the technology before the legal aspects of blockchain are discussed.
Blockchain and the Law does not fall prey to overly optimistic predictions of blockchain's potential found in many other blockchain books. Potential benefits are systematically followed by a listing of potential drawbacks, emphasising that blockchain is a dual-use technology. De Filippi and Wright also avoid the trap of incorrectly labelling blockchains “tamper-proof”, as others have done, instead using the more accurate term “tamper-resistant”. Blockchain entries can be reversed by a majority of miners (those contributing computing power to the blockchain) in a so-called “51% attack”. Although this may be costly (estimated at over $1.5 billion for the bitcoin protocol mid-2017, according to one source cited in the book), it is not impossible.
The authors state in the first few pages that blockchains “are not centrally maintained”. This is a convenient way to explain the difference between blockchain and traditional databases and is certainly true for the earlier blockchain initiatives, such as the bitcoin or ethereum blockchains. By now, however, blockchains come in many different types and shapes, including ones operated by private institutions much like centrally controlled databases. The difficulty of writing a book on blockchain is that it risks being outdated almost as soon as it rolls off the printers, as the technology develops rapidly.
At times the need for simplicity and readability is traded off against technical accuracy or nuance, which may well be a sound choice for the technical explanation, but not necessarily for the legal analysis of blockchain technology.
The book's subtitle is “The rule of code”: a Lawrence Lessig-inspired theme running through the book. The authors suggest that blockchain code gives software developers the tools to “void jurisdictional rules” and that blockchain-based applications do not depend on laws but on lex cryptographica. “As a general rule, because of their decentralized and transnational nature, blockchain-based systems exhibit a degree of alegality.” This is confusing and not particularly helpful to understand the legal implications of blockchain. Blockchains are not outside the law. It may have been more helpful if the authors had limited their analysis to their more accurate statement that blockchain-based systems merely are “harder to control and regulate” and that existing laws may not cover all aspects of a new technology such as blockchain. This is not unique to blockchain technology, however.
The enforcement difficulties identified in the book are more pronounced for public, permissionless blockchains, on which the book focuses, than for private, permissioned alternatives. The latter form a good part of current blockchain activity and are the preferred choice for a number of government and commercial applications (such as financial services or supply chain management). These private, permissioned blockchains do not necessarily result in the same legal risks. For example, they may be relatively centralised, making it much less problematic to identify the data controller under the EU General Data Protection Regulation, for example, or to enforce anti-money laundering laws.
Chapter 3 discusses digital currencies and decentralised payments, as one application of blockchain technology. While we associate crypto-payments with potential tax evasion or circumventing anti-money laundering laws, De Filippi and Wright correctly point out that the pseudonymity of many (permissionless) blockchains may facilitate enforcement, as it helps authorities identify account-holders and their transaction history through meta-data and transaction pattern analysis. The drawback is that this may “empower new forms of mass surveillance”, they warn.
Regulators have stepped up enforcement against crypto-currency issuers in recent months. Enforcement actions, so far, mainly target outright scams or blatant violations of securities laws. Increased usage of crypto-fuelled transactions on a blockchain may lead to another set of regulatory concerns: what if a crypto-token has changed hands on a blockchain in violation of the laws of country A, but not of country B? Such “tainted coins” may be discounted for users in certain jurisdictions but not others, undermining the fungibility of digital currencies. This is not a problem inherent in blockchain, but a problem in how most blockchains and blockchain-based applications currently operate. It is technologically feasible to tailor transaction rules to local laws, but at present there is little incentive to do so.
Blockchain technology allows for the implementation of so-called smart contracts, the legal validity of which is discussed in ch. 4. Smart contracts are executed automatically as soon as the conditions laid down in the code are met. Not all contractual clauses lend themselves to code language, De Filippi and Wright warn, pointing to ambiguous contractual clauses such as those on “good faith” or “best efforts”. Hybrid arrangements (combining prose and code) may help clarify the parties’ intent, which is particularly important where natural and code language contradict each other. As the authors note, courts will ultimately “construe the underlying code according to long-standing principles of contract law interpretation and, if necessary, the help of experts”. Although “there may not be a way to halt the execution of a smart contract after it has been triggered”, the difficulty of legal intervention should not be exaggerated. For permissioned blockchain services in particular, traditional legal means such as penalty payments may be as effective as for any other service provider.
De Filippi and Wright correctly point out the privacy concerns of smart contracts “because of the transparent nature of blockchains”, adding that privacy-preserving solutions (e.g. zero-knowledge proofs as developed by Zcash) are not quite robust yet. Nevertheless, it should be added that the partnership between Zcash and one of the largest investment banks at least suggests that scalable privacy-enhancing innovations may become commercially available in the near future.
Cryptocurrencies and so-called ICOs (Initial Coin Offerings) were a hot topic in 2017, although the hype seems to have lost much of its lustre since the crypto-bubble burst in early 2018. Chapter 5 looks at these smart securities and derivatives. The chapter briefly discusses the difference between utility and investment (securities) tokens, a topic on which Wright has written in much greater depth elsewhere. Shortly after the publication of the book, a US Securities Exchange Commission official stated that bitcoin and Ethereum are not securities and recently added that the Securities Exchange Commission will provide “plain English” guidance on which tokens qualify as securities.
Smart securities and derivatives promise to speed up settlement time (lowering settlement risk). However, De Filippi and Wright warn that decentralisation of securities and derivatives transactions through blockchain also limits the benefits of financial intermediaries (such as clearinghouses), which can act as buffers in financial markets in times of crisis – a warning often overlooked. The authors, furthermore, argue that the transparency of blockchains could “negatively impact both corporate governance and financial innovation”. Financial innovation could be limited, for example, when a hedge fund's trading strategy becomes visible if its transactions are recorded on a blockchain. Likewise, activist investors could be discouraged if their blockchain-based securities purchases would be visible for others, the authors argue (assuming such purchases are below the levels that trigger mandatory disclosure). A potential solution is to use separate public addresses (comparable to a bank account) for each transaction. As blockchain matures, the privacy-preserving innovations such as zero-knowledge proofs may become more robust and scalable. Moreover, not everyone would agree that greater transparency in the financial and capital markets is necessarily negative. In addition, a superficial reference to the alleged (but controversial) positive effects of corporate raiders would not seem to support the authors’ conclusion that “[o]verall … the benefits produced by a blockchain-based system would be offset by the emergence of a riskier financial system characterized by companies with weaker corporate governance practices”.
Chapters 6 and 7 discuss some of the risks and benefits of using blockchain to store data, such as health data, voting records or land ownership. The warning of unwarranted privacy and other concerns is a welcome change from overly optimistic assessments of blockchain's potential. These concerns are more prominent for the public, permissionless blockchains (the book's focus) than for the many private, permissioned blockchain solutions that have been developing at rapid pace in the past months.
Chapters 8 to 10 assess how blockchain can alter the future of organisations by allowing for decentralised decision-making and automated execution. For companies, for example, blockchain could simplify shareholder voting and render corporate decisions and procedures more transparent, the authors argue.
The final two chapters tackle the issue of how to regulate blockchain technology, a useful read for policymakers. The authors discuss different policy options, such as regulating end users directly (an option the authors do not appear to recommend), ISP providers, search engines, blockchain intermediaries (wallet providers or crypto-exchanges), miners and transaction processors, developers or hardware manufacturers. Importantly, the authors also point to the role of social norms in regulating blockchain networks. Less convincing is the argument in the first part of ch. 12 on the possibility of transposing laws into blockchain code, although the second part of the chapter describes the risks of “algocratic governance” to provide a more nuanced picture. Governments can use blockchain to streamline certain services or record data, but the feasibility and desirability to transpose laws into code (which the authors argue may reduce the need for interpretation or facilitate automated enforcement) would require a more in-depth discussion than the limits of the chapter allow for.
Blockchain and the Law is an introduction to blockchain technology for policymakers and lawyers more than a systematic analysis of applicable laws, case law or enforcement actions. The authors should nevertheless be commended for offering an excellent introduction to blockchain technology for those with a legal or regulatory interest in the subject. Readers not off-put by the emphasis on US-oriented and ethereum-based examples or by the focus on public and permissioned blockchains will find in Blockchain and the Law an easily accessible initiation into a technology set to cross regulators’ and lawyers’ desks sooner rather than later.
