Navigating Developer Liability in Open-Source Code by Eva Wong | Devcon SEA

[Music] hi everybody uh I am Eva Wong thank you for my little Entourage for helping me bring things uh to the stage uh so just I'm just going to pause for a moment and see if anyone else is coming to this talk um so developer navigating developer liability in open source blockchain projects it's quite a long title and I am very conscious that I am on stage five on the last day of Devcon and right next door we've just had Peter V valkenberg talk about tornado cash and right now Hart Montgomery is talking about open source Licensing in the Linux foundation so quite a lot of big acts to follow and I'm up here by myself after that lovely convivial panel that we just had so who am I and what am I going to be talking about today uh director of legal at parity Technologies polka do so uh how are there any lawyers in the room here oh my God I think we should all go outside afterwards and have a little uh support network Therapy Group group therapy session congratulations and I'm so pleased that there are other lawyers around because you are a web three lawyer and what does that mean does this picture resonate with you at all uh a little bit Yeah I think earlier on one of the uh moderators was asking me what is a web3 lawyer and what do web 3 lawyers do well well uh it takes a certain personality type to be happy navigating the uncharted waters of law where it law and Technology meet and simply the law does not keep up yet with what the technology is capable of and that goes to it impacts also other areas not just law and um I think the certain personality type is someone who's curious who wants to change the world who also uh wants to intellectual stimulation but also doesn't mind the constant anxiety that is associated with being a web3 lawyer I work at parity Technologies parity Technologies for those of you who don't know co-founded by Dr Gavin wood also ex- co-founder of uh ethereum of course parity Technologies is um a core blockchain engineering company and one of the main contributors to pood do uh hopefully most of you have heard of polka dot and why am I talking about par Technologies a little bit more I'm not here to you know promote parity Technologies but obviously those of you who want to know about the tech uh please speak to some of my colleagues who some of them might be around uh we just had our own developer conference Subzero prior to Devcon and there are some amazing projects that are going on and if you're a developer and you're looking to go work somewhere with some pretty exciting things then parity Technologies is one of such organizations um what's unique about parity technology I think is that where there's uh 75% Engineers 25% support staff and we exist to support all the engineering that uh Ingenuity and Innovation that happens there um why because as a director of legal I'm constantly thinking about things that protect the company but also have to protect the developers because that's 75% of them spread across 37 different countries so when I say web3 lawyers are special uh web 3 HR Specialists ESP special web three accounts and finance have to do with new ways of accounting and Finance uh considerations when it comes to working in this area um polka dot I'm not going to explain the technology of polka do but I am going to point out a couple of things about polka do which are fairly unique which impact the conversation around liability uh poodot is one of the largest Dows and also the only major web 3 protocol in which all governance is approved and conducted entirely on chain so bear those things in mind as I go through this talk cavat disclaimers I'm a lawyer the lawyers in the room will know I am here to talk about law but none of this is legal advice and uh that is a corgi not a Sheba Inu uh there's also jurisdictional considerations I am you can tell by my accent I'm actually Dutch Hong Kong Chinese but I live in the UK I live in the UK and I'm qualified in England and the Welles so some of the cases I'm going to talk about are not UK they are French they are uh Netherlands Dutch but I'm not Dutch qualified although I am Dutch and uh the US so but the key takeaways from some of these cases that I've sort of absorbed into my mind uh the theories of law still apply in other jurisdictions to differing degrees so it's still worth thinking about as a lawyer even if it's not necessarily your jurisdiction uh here we go this talk I'm going to talk about types of developer liability or types of liability that affect Developers and and then I'm going to talk about uh some particular cases that might be of interest and what I've taken away from them and then I'm going to talk about if you're a developer how you might want to mitigate and protect yourself so first of all I was assuming that this is Devcon therefore it will mostly be developers in the room here if uh that is the case then you're a developer who are you what are you doing that impacts what kind of liability might uh attract you or you might be liable for um so you might be an employee quite likely you could be a contractor you could be a contractor for multiple customers uh receiving your service you could also be an individual contributor to different blockchain projects you could be a dow participant you could be a dow participant participant of more than one Dow so in these different aspects you could potentially be liable for different things on that basis oh also worth pointing out that some Developers are also co-founders CEOs and directors of companies that is a whole different ball game about of liability that I can't talk about right now but worth thinking about if you're in that position so types of risk and liability so for those of you who are lawyers this will be familiar territory for those of you who aren't this is the only bit where I'm going to attempt to explain some legal stuff uh using cartoons um so civil liability I explain it quite simply as often this is contract based so if you agree something with someone you're going to do something or they're going to do something you write it down if one of you is in breach you sue the other person that's contract law sorry lawyers very very simple terms here uh negligence or otherwise the law of thought which was something that sent me to sleep at law school but brought to life by this uh interesting cartoon of uh a ginger beer bottle and a snail uh this is the this is the area of law about duty of care where there isn't a risen contract between two individuals or two entities and um a it's more about whether there is a reason that one person might be responsible to be to take a reasonable level of care and could be responsible for another person where they suffer a loss so um just talking about this the the ginger beer and the snail stems from a 1932 case in Scotland where a lady drank a bottle of ginger beer there was a decomposing snail in it and uh the manufacturer of that ginger beer obviously does not have a contract with the individual who drank that bottle of ginger beer so how do you establish that the ginger beer manufacturer is at fault well this was the case that established uh duty of care and this becomes relevant in the cases that I'm about to go and discuss and uh since we're talking about open source as well uh an open source license is a form of contract and and a a normal proprietary software license is also a form of contract so when it comes to open source licensing if you're in breach of an open source license that's a contract issue so this is all civil liability when it comes to criminal liability and why does it matter to a software developer uh well obviously if you create code that intentionally goes about to break the law I.E you're going to go hack a government system where you going steal some funds then that's obviously criminal liability however in the context of some of the cases that we're thinking about and what might be less obvious and more of the murky Waters and unintentional consequences of uh laws being used against people who don't necessarily expect them to be uh liable for certain things it's uh where you might be developing a technology neutral an a neutral platform that is that is that that you don't necessarily know how people are going to use it this is particularly the case in blockchain because of immutable self-executing smart contracts case studies case studies uh most of you will probably recognize some of these people and there was a keynote speech by Peter Van valkenberg next door just about an hour ago I think on tornado cach specifically uh about privacy I caught a little bit of it if you haven't seen it I'm definitely going to go watch it again he I think he did it in the in the in in poetry form with cartoons it sounded amazing I'm definitely going to watch it I hear some I see some nodding there and I was given a leaflet by uh one of our ex Rockstar par Developers um Engineers uh about tornado cach anyway so um tornado cach Netherlands case Alexi perv us case Roman storm uh these are ongoing cases so very much subject to change and very much I'm not going to talk about the merits of the case but I am going to talk a little bit about the impact of some of these cases and why there are some key takeaways for those of us who might be developers or work in a company that is 75% uh core blockchain engineers so Alexi perv earlier this well he was arrested shock horror uh many headlines many many reasons to be very concerned about this but the outcome was uh he was convicted earlier this year for 64 months for his participation in tornado cache tornado cache is a privacy mixer which in itself privacy is a basic human right uh however some of the activities that happened a percentage of the activities that happened on tornado cache were not quite so innocent so Alexi perv what is the key takeaway here so the Dutch Court said because because he was aware of the misuse of tornado cache by criminals continue to maintain and develop the system without implementing adequate measures to prevent its exploitation for illegal purposes contrary to claims of tornado Cash's decentralized nature perv and his team exercise effective control over the platform so the key words there are effective control over the platform particularly through its web interface the control implied a responsibility to prevent its use for unlawful activities a responsibility that was neglected so this ruling is very precedent setting it's in the Netherlands but it means that open-source developers could be held accountable if their Creations are deliberately designed or knowingly maintained in a manner that facilitates criminal conduct that's Alexi per the case is now going on appeal uh there are funds for uh people who want to contribute to his legal defense and um Roman storm he was arrested sure a few months afterwards and the case is going to trial in January next year that's in the US and the indictments are actually not so specific to code development more about conspiracy to commit money laundering conspiracy to operate a unlicensed money transmitting business conspiracy to commit sanctions violations but the indictment does talk about the creation of torado cach as well as the operation and promotion so the trial is the the discussions in that trial will be uh instructive for developers of De centralized platforms going forward um tulip trading tulip training some of you might recognize this man as Dr Craig Wright who is the only person to be proven not to be Satoshi because he decided to take a whole bunch I mean this is a copyright case I don't want to go too much into the copyright case but you can read up on it copyright case very interesting uh he is not Satoshi but tulip trading is a company that he owns and uh what he did what the company did is that they alleged to have claimed they they claimed to have lost access to billions of dollars in Bitcoin due to a hack and they argued that 16 Bitcoin core developers had a duty to provide this goes back to the snail and the beer bottle they said that there was a duty to provide access and recover uh the stolen funds by implementing a software patch because these devs had control over the Bitcoin network uh H the high court said nope there's no duty of care because of the decentralized nature of blockchain and there isn't a sufficient relationship that exists that would create these kind of obligations so few Sor Sor of relief there however the court of appeal so um you know how I said Alexi perv is taking his case to appeal in law in most countries the first decision means you can go and get a second opinion on it effectively you can go and appeal it by creating more uh by providing more evidence or providing different arguments so the cause of appeal in this case in tulip trading where the developers were like yay we don't have responsibility uh tulip trading had money and said okay I'm going to take this to appeal we're going to take this to appeal and the court of appeal allowed the possibility that a duty of care might app apply and they sent the case back to the first Court uh because they said that if the developers can alter the protocol have the authority to implement changes access user assets on a blockchain or have significant influence over the network functionality they might bear responsibilities to others so they might have a duty of care and this could possibly establish a new form of Duty of care in decentralized contexts uh and that could include doing what um T trading we're asking these developers to do so the takeaway here the court didn't actually find that a fiary duty of care exists but it left the door open to say that it might exist and because Craig Wright lost his copyright case uh or the identity case this case has now been dropped discontinued I mean tulip trading has been discontinued so we won't actually know originally you know we were all on tender hooks on the edge of our seats waiting for tulip trading to go to court to see what the outcome was going to be but right now we don't know uh but the takeaway is that it's in inclusive but it's possible that developers might owe a duty of care to protect user interest if there is an element of control and influence that's the UK so we've gone Netherlands us UK negligence criminal and now we go to UK five minutes time okay UK there's a lot of legal cases here so I'm sorry if I'm speeding through I'm conscious of time but there's a lot to cover UK da is interesting because that's a chatbot and some of you might know that uh the idow um individuals the token holders the members of the the idow were served court documents through a chat box uh pretty novel pretty pretty novel so yeah law enforcement finds novel ways of enforcing what they need to enforce when they want to Uka is relevant said this is a regulatory matter this is the cftc that's the Commodities Futures and trading um commission they uh regulate Commodities training and they felt that ID da was offering Commodities trading without proper registration and the precedent that was set here is that the Court held that UK a DA is a person and could be liable for these for um compliance with these regulations and not just to be held but is actually was actually violating the law and prior to this it was believed that Dows and defi platforms were protected from regulatory scrutiny because because they are so decentralized this was the a pivotal case in the US again it's not necessarily the case in other jurisdictions but um it is the case here that a dow won't protect you in the US and um an individual token holder could also be liable for the actions of a da um there are some nuances here and I think the lawyers might find this interesting because this was a default judgment case uh the case no no one argued against what the regulator was alleging so uh that's because it's a DA and no one stood up and that might be intentional because maybe nobody wanted to stand up it was also the case that we would believe the founders allegedly formed Ida in order to pass everything over to Uka to avoid liability so this very much uh circumstantial and very lawyer-like I'm saying it depends and it was in the US but some key takeaways there I think to be had and then at the end there we've got the telegram case or rather uh the pavl jof case uh last year no this year August um August CEO of a major communications platform gets arrested in Paris like Alexi perf it was like WTF what's going on here is Elon Musk going to get arrested if he goes to France uh so again you need to look at the nitty-gritty of what actually was being alleged and um the reasons why he was arrested so he was arrested and then there were six charges brought against him uh I am going to go into into those six judges because it's relevant there's complicity in managing an online platform to enable illegal transactions by an organized group refusal to cooperate with law enforcement authorities complicity in the dissemination of child sex abuse of material complicity in drug trafficking providing cryptology services without proper declaration importing C A cryptography tool without prior declaration those last two particularly got quite a lot of us quite concerned because it's cryptography um now breaking this down and if you separate these charges it's actually unlikely that this will have any impact on developer liability I believe and the reason why I think that is because the arrest is based on a French law not a French law where a CEO is actually the representative who is responsible for any criminal activity of a company so he was arrested not because he was a developer he was arrested because he's the CEO and in France you arrest the CEO if the company potentially has done something illegal have they done something illegal actually it's probably more the case that yes it's a technology neutral platform and then you have the analogies similar to tornado cache you have the analogies like if you're a lighter manufacturer would you be responsible for arson if you are a manufacturer of a cricket bat or cricket bat I mean baseball bat uh either bat would you be responsible for you know the injuries that that bat could have uh like you know guns don't kill people people rappers do apparently so um that the telegram case brought about loads of discussions about this country kind of thing and it's interesting because it telegram wasn't intentionally developed to allow money laundering or drug trafficking but it's now a criminal ready platform and criminality occurs on it and telegram wasn't doing an awful lot to support law enforcement authorities so this is why he was arrested uh it's very much to say we can do this we're going to bend the law so that we can do we can achieve the agenda of law enforcement so in contrast t cash was purposely developed anonymized transactions is that illegal in its own right no telegram has however now done more moderation and is uh is is is probably uh cooperating more with law enforcement I am going to be very shortly out of time I B A click how to protect yourself uh lawyers are your best friends of course I'll say that but you know lawyers like I said you know both three lawyers are pretty unusual we're here to co operate facilitate collaborate navigate with developers and with companies uh second way you can protect yourself to the licensing Point get your code in order make sure you do audits make sure you are compliant with any open source licenses that you take from out there or you build upon uh if you do release code with open source then consider your licenses with care so web three web3 lawyers are very helpful because we have to interpret all of the stuff other ways you can protect yourself uh we've talked about decentralization we've talked about um control of networks and influence if you choose the more decentralized this is one takeaway I think I have is the more decentralized the less likely there is a chance of liability attracting uh if you're going to go if you're going to participate in Dows which um I think most of us probably are are a member of a DA in one form or another choose carefully what you vote on uh be and consider how that governance system works and key takeaways always do your own research and talk to your lawyers and proceed with caution I am really over time aren't I so uh how are the questions looking any questions all right so we do have one question over here Eva do you want to take this one a simple answer is no but I am getting educated um can I can I get a picture of this so that I can go and uh look into this this is very interesting uh whoever asked a question would they like to speak so that you can share your knowledge with all of us yes please is that possible can we share the mic are we allowed to share the mic because this is a collaborative education session can you come up is he allowed to come up oh okay we'll talk afterwards this is brilliant so in in the polka dot world we actually have a uh a thing called poker legal where all the lawyers get together from the ecosystem and we share information like this and uh I would love to learn more because this is interesting uh other questions anyone else was that the only one we don't have any live questions rolling in but feel free to scan the QR code if you have more questions Great I Am overtime but I'm not because there weren't that many questions after all uh well thank you very much everyone all right thank you thank you hope it was helpful