“No Positive Use for Privacy?”- The Perception We Must Change. Ameen Soleimani, Oxbow

Hi, my name is Amin Solmani. I'm the CTO of Oxbow and happy to be here in View. [Music]

Hi Am I?

Hello. Thanks for coming.

Thanks for having me.

Uh for the context, we are at DEPCON day three almost over actually. Um yeah, and we are just discussing stuff and privacy.

Yeah. A lot of privacy uh projects here this week.

Yeah. Very cool.

Yeah. Yeah. Yeah. Yeah. So, we'll talk about it later, but for people who don't know you a lot, can you just say like few minutes like of your personal story, how you ended up, where you are, and where you are?

Hi, my name is Amin Solommani. I'm uh the CTO of a company called Oxbow. We build privacy pools. It's uh, you know, onchain privacy but without the terrorist. I've been building smart contracts for close to 10 years.

I worked at Consensus back in the days, the largest, you know, uh, startup in Ethereum, built MetaMask, uh, Nosis Inferior, a bunch of other things. Uh, went from there, built some payment startups, uh, built a stable coin startup called Rye and built some Dows, Malik Dowo, um, and and, uh, some others around that and, um, now mostly focus on privacy.

Yeah. Cool. Yeah. So, uh, why do you focus on privacy that much? Like what's is it personal or you just think it's important?

Like is there any backstory behind that?

Sure. It's a little bit of both. Um, so like I was uh the summoner or you know one of the co-founders of Mullikdow. Mik in this is in 2019. Malikdow gave all of the initial grants for Tornado Cash uh because we as Ethereum nerds were very jealous of Zcash.

We thought it was really cool

that they had private payments

uh and we were, you know, kind of

jealous because we thought it was silly that every time we send money to anybody, they can see our whole transaction history. I can see how much money they're making.

And we didn't want that. And so we figured out how to get Tornado Cash going. We gave them some grants. Uh they shipped a great product and you know, initially it seemed like everything was going fine. Uh and then only later did it become a problem.

Like initially ETH was $100 and then later ETH was like $4,000 and then uh North Korea hacked a video game for $500 million and started running hundreds of millions of dollars, you know, allegedly through uh tornado cash and then the program got sanctioned and uh the developers were imprisoned and are now awaiting trial uh Alexi uh in the Netherlands and Roman Storm in uh America in the US. So, uh, why privacy? One, because we want to build the thing that we originally had, which was something like, you know, tornado cache,

but fix the problem. And part of the problem was that we didn't realize the extent to which, you know, terrorists might want to try and use these tools. and uh them using these tools got this program like sanctioned by the US government and it makes it harder for everybody else to use the tools to get their money accepted and so being able to kick them out

uh and have you know privacy for the good guys so to speak allows individual users to benefit more from privacy systems than otherwise. Uh, and then secondly, we're trying to promote a narrative of privacy is for the good guys, and it always has been. And the Tornado Cash team, actually, not enough people know this. They built a compliance tool themselves where you could actually use the secret note that you get when you deposit

that you need in order to withdraw. And you can uh prove which specific deposit belonged to you. And so that allowed you to, you know, identify yourself, so to speak, to like a regulated financial institution. And there was a whole central plan of how to get this thing uh regulated and then the sanctions basically threw all that out because uh then the you know it the whole thing was just banned. And so one of the lines that the judge in Alexis's case said for example was that uh there's no positive use case for privacy.

And I think that is a perception that is really important to change. And so we have to build products that are useful enough for everyday people so that the world understands that privacy is not just for criminals. And if you ban privacy, then you make it so only criminals have privacy and that's not what we want.

100%. Thanks for reminding by the way about the tornado cash case for people who don't know. Uh but what's the current state of it if people because it's been a lot of

it's been 2 years. Yeah. So Alexi has already served close to a year and a half because he lost his case and he was sentenced to five years and so he's only out right now and he's out on like house arrest, right? So he's got an anklet. He can go around Amsterdam but you know can't like leave uh Netherlands or anything.

So um he has an appeal uh trial that is pending. I think that'll probably be early next year. Roman uh his trial is coming up in I think about a month and it'll be in New York. And so um he's once again fundraising for his uh trial legal defense. And so if you have the means and you're interested, please go to uh free Alexroman.

com uh or uh we want justice uh.com. Uh, and those two link to the uh, legal fundraising effort.

Mhm.

So, the the I'm I'm like I hesitate to be too optimistic. You know, Trump got elected. There's some there's some positive things, right? Like the Department of Justice submitted a memo that said, "Hey, we shouldn't hold uh blockchain developers legally liable for the crimes of the users of their platforms." And then the Department of Justice, the prosecution in the case is like, "Yeah, we're going to keep going."

Right? So, it's like some it reminds you that the government is not like one group. uh it's like its own battlefield and you're trying to or you know work with the people that you can uh work with inside to try and get the best outcomes possible both for Roman and for uh privacy law both for developing privacy tools and for uh using privacy tools.

Yeah. Uh you mentioned it a bit about like good and bad people.

Yeah.

Which is really hard to define what is good and bad. But like if if we don't go deeper into that and like keep this black and white mentality like do you think is it even possible to like exclude terrorist of chain like the thing and how we can do that? Uh, I think yeah, there's there's some people that are like, I don't know, a little defeist about this that I don't buy it because you can like, let's say it was very hard to figure out who they were. At the very least, you can see the onchain hacks and the money that's been stolen and that you know about and you can exclude that,

right? And so I still think it's worth it to be able to say, "Hey, look, like I'm not going to help uh give or get privacy from the people who stole money from my friends DeFi protocols." I think that's worth doing. I don't think you're going to get like every tax evader, drug dealer, you know, uh the authorities would have to work pretty hard to notify blockchain developers through analytics tools like chain analysis and whatever about those addresses being not, you know, good for uh to take money from or associate with. Mhm.

But that's not um that's something that the authorities have to contribute to to helping with.

Okay. And um can you like explain a bit about the oxbow like what's that and yeah

why it's important.

So the whole idea of good and bad somebody has to be the judge of uh what is good money bad money. Um, and so the way privacy pools works is that uh, Oxbow, our company, plays a role as the maintainer of the white list of approved deposits. And so we periodically publish an updated list. Whenever you deposit into privacy pools, there's a waiting period. So you might wait one day up to seven days.

And during that time, we're looking back your transaction history, seeing where you got your money, uh, and and you know, do we accept the source of funds? And so, if it's something like a reputable exchange, KYC, Coinbase, uh, we'll probably accept it.

Uh, if it comes from like a known ENS, you know, lots of activity, um, then we'll also probably accept it. You know, uh, if it comes from like a sketchy no KYC crosschain thing, we probably won't. And if it comes from other privacy protocols that aren't up to our standards of uh excluding uh bad actors, then we also won't. And if it comes from obviously like known hacks and and stuff, we won't uh accept it either. And so when your money is approved, then you can uh and only then can you withdraw privately.

Uh and so then you are part of the set of users that were accepted onto the uh white list. And if you don't get accepted, uh you can withdraw your money back to your original address. So we never uh control anybody's money. Uh we can't freeze any money. We can't steal any money.

Uh the contract is immutable that holds all the money and the users can take their money back to where they, you know, deposited it from at any time without our permission. So that's uh helps it be a non-custodial system. Um which also means we're not necessarily a money services business. So, we're not trying to do like KYC. Uh, and honestly, I don't think KYC is good enough.

Uh, because I don't really care what ID you show me if I see that the money came from like a DeFi hack.

So, you still need to make sure that the money didn't come from the DeFi hack.

Yep.

Privacy is a base layer. What's your thought on that? Like, can you imagine?

It's ambitious. Uh, I can imagine it. I'm uh I'm a little bit like in awe of how crazy it's like a big update. You know, all Ethereum would go private, you know, privacy by default.

Uh I'm also horrified uh because we kind of played this game. We beat this game. Like nobody anticipated that like North Korea was going to come out and start being a power user of the system.

And so I think we should just not be naive uh today and learn from history. And so I think I would be very excited about that kind of proposal if it also allowed for people to voluntarily dissociate maybe using something like Oxbow uh from some of the users that are using that. And the hard part about that is that it makes everything on Ethereum part of the anonymity. every time anybody sends ether like specifically there's certain EIPs that implement base layer privacy and the the one that seems to have the most traction is the one where if I send ETH to a fresh address uh it it it may or may not be a deposit into a privacy system

and so when I do that deposit it from the outside world it looks like I just sent ETH to a fresh address but later uh I can prove that that was one of the, you know, privacy uh system addresses and withdraw that money in a way that nobody then can know which of the deposits uh it corresponded to. And so what it means that the complexity of building a white approved set of white lists for this is much harder because you have to monitor literally every single send on Ethereum.

Yeah. And that's very ambitious.

So it's it's a lot of work. I think if privacy pools works for a couple years first.

Yeah.

Uh in production then maybe we'll we'll scale up to something like that. That would be uh I think a more I don't know riskaw aware version of of making this uh

so can you expand a bit on privacy pools because I know that you've been involved uh like what's that starting from what's that and why it's there and what's the road map of that? Yeah. So, privacy pools was an idea that Vitalik had after the tornado cash sanctions in 2022. And he had the idea that we can actually uh allow people who withdraw from a tornado cash-like system to prove against a smaller set of the deposits. Mhm.

And so I helped make a prototype of the system uh at ETH Denver in uh 2023 and then um wrote a paper with Vitalic uh in um mid 2023 about this.

Uh and the idea of the the paper just describes you know how that could work and um then we started Oxbow as a company to implement the system. Mhm.

And so like in the idea of the paper, it was more of like a neutral protocol, kind of a free-for-all. Users would be able to provide their idea, their their set of the deposits that they would like to be associated with. Um, and so you could have multiple different groups of users all using the same system, right? You could have like you know the world deposit and then I prove against that I'm in compliance with the uh practices of like you know different European countries right I could say I am in compliant with Switzerland's whitel list of deposits I'm compliant with the US's you know and those could have overlap and that that um has some network effects that it it impre you know improves the anonymity sets of everybody uh but the system that oxo is building is not that yet because our lawyers asked us, they said, "Hey, look, uh, does does this, you know, permissionless, credibly neutral version that you and Metallic wrote about, uh, if the criminals do not make it onto your association set, uh, doesn't that mean that they have a privacy system amongst themselves?" And I was like, "Yes.

Can you make it not do that?" I said, "Yes." And so the way it works today uh is that we manage the approved white you know deposit whitelist as a company there's only one and you have to follow ours and if you don't follow ours you can go back to your original address maybe one day

I think this is kind of the zero to one approach like first you just make the system that works and like then a bunch of people will complain like oh why don't I get to choose the list and then we're like great now let's make 10 lists and let everybody choose and you know uh but I The path is through one system that works and our plan is to you know right now it's on on mainet go to privacypools.com uh you can deposit your ETH uh we're adding ERC20 support and we'll go crosschain to other EVM uh systems soon.

Okay. And um maybe you can expand a bit on like the general road map of Ethereum for the next 10 years like how do you see that and uh what problems do you see any challenges as well? I don't know, man. Ethereum over 10 years is a

This is far above my pay grade.

I know. I know.

It's a tricky one.

Let's be glad it's not my job.

I mean, it's it's hard to predict this world even for one year. Like, so

I know that. I know that. It's um

I guess like layer one will scale more. People will figure out the layer 2 crosschain UX uh wallets will get better. uh layer 2s will get faster and cheaper. Uh zero knowledge systems will improve. Uh so the proving times will be lower, the costs will

I think some of the things that I'm most excited about are things that use zero knowledge uh for like social purposes. Mhm.

It's like money is one example of a thing that you know people derive benefit from and you know privacy is important for uh but like I think governance and voting is really exciting. Uh some of my friends work at Raro uh in Ukraine

and they built an app called Freedom Tool. So I went to ETH Kiev uh with Vitalic and like learned about Freedom Tool and uh maybe you talked to to some of those guys. have you

um a bit not not that deep. So you can expand.

Yeah, sure. So freedom tool is really cool and it basically allows them to provide a zero knowledge proof of a passport that you provide. So I can be like I have a valid passport

uh that is signed by the issuing authority and it says I'm over 18 and so then you can have like a shadow election. And so they did this to troll the Russian uh elections and they made a system that allowed you to use your legit

uh passport and then say like I vote, you know, against Putin or or whatever and people can verify that this this works out and it's fair. And

uh when we were there, we realized that the Russian passports and the Iranian uh Islamic Republic passports use the same hashing and signatures. And so we forked the uh freedom tool and made a a little app called Iranians.vote and uh trolled the Islamic Republic election uh by allowing a vote of no confidence. So you could like use your passport and then say I vote no confidence in the Islamic Republic in your elections. Uh

um so I think I I think that is a small example of the kinds of things that'll be a lot more important in the future

where I could actually see in 10 years

like legitimate society governance infrastructure being built on chain and on zero knowledge and I think that's a one of the things I'm most excited about contributing to to building and tornado cache really it was the it was the second zero knowledge proof deployment in human history, right? We've come very far away. Like first one ever on Ethereum, second one ever. Uh and now we're all like, you know, we got 10 10 of these, you know, feels like it's everywhere. But, uh it's still really powerful and I'm still really excited by the the potential impact.

Like I remember in 20 I think it was 2020, but uh Andrew Yang showed up at ETH Denver and he was talking about how we're going to put voting on the blockchain and everybody who knew what they were talking about is like no don't do that. That's crazy. Why would you do that? But with with certain zero knowledge proof systems like you could actually do it. You can do a good job.

So excited uh about that part.

Yeah, that be interesting to see. So, let's see how it goes. And um uh I want to hear your take on cipher punk specifically on like neo cipher punk. What do you think like what does it mean to be a cypher punk day?

Yeah. Did you see my quote in this uh Dash retweeted me was on stage. Yeah.

There there's uh this was from uh Amsterdam I was hanging out with. There was like a cipher punk panel. Yeah.

And people are asking like what does it mean to be cippher punk? And I actually think that the words matter. uh cipher meaning code and encryption and then punk is like a group of people who seem like they're on the outskirts of society because they have something that they care about

uh that they're trying to promote and make like a value. Uh I call it moral entrepreneurship like you you really think something is is good for society. So being a cipher punk means that you believe enough in like the value of encryption uh for society that you're willing to be like a fringe weirdo uh for a while while society's like this guy like what are they doing you know but then you eventually build the tools and the regulations and knowledge and you know um that society adopts your culture. And so now we don't really think about it too much, but we do live in some of the victory of cipher punks that came before us, which is that like the government websites are all using encryption, HTTPS, the little green lock on the browser that makes sure you know the people like worked for this. They were arrested for this uh until we got like sane rules uh about it.

And so I think today what it means to be a cipher punk is uh the same kind of thing where you know uh private money seems like a really bad how could you you must be a criminal type of thing. But I think in the future it'll be based on an understanding that like creating honeypotss of financial information that can be hacked and exploited and abused and uh put people in danger are not a good idea. M and maybe we don't want to have those. And so maybe the people building private money systems and so forth were correct. And uh yeah, so I I'm into being a cipher punk.

I think one of the most interesting takes on cipher punk was what Virgil Griffith told me. Virgil is a friend of mine who used to work at the Ethereum Foundation. He's been in prison for the last 5 years for going to the North Korea blockchain for Peace conference, which was total scam. He He gets there and it's like him and like four other people that he went with in like a room with 30 North Korean officials. They're just trying to figure out how to get out.

So, they play along and then they get out and he goes to the FBI and he's like trying to inform, you know, them of the problem. And then he hands them his phone. He's not there with a lawyer unlocked. They go through his messages. They see him talking about sanctioned stuff.

uh not being too careful and then uh they basically arrest him and imprison him for 5 years for conspiracy to violate uh sanctions. So So Virgil went to the FBI and then tried to inform him on the North Korean events that he, you know, participated in and then they uh took his phone. It was unlocked. He didn't go there with a lawyer. And so uh he was arrested and imprisoned for 5 years for conspiracy to violate international sanctions.

He just got out, had dinner with him, and he said that the cipher punks were not ambitious enough.

Oh.

And it was it was an interesting take and and and the reason he said it is because he said that the cipher punks were obsessed with fighting the man.

Uh but they didn't get beyond uh fighting the men. Uh there is there is an opportunity to build society better and not always feel like you're fighting. Uh and and the the endgame of fighting the man is like building a better man. Man man not meaning like a actual you know male uh human or but like the man as the uh proxy for like you know big bad society or something. But uh his idea is like we should be cipher punks should be like pro-social, pro society, you know, trying to build the uh societies that protect people's freedoms and sovereignty and privacy in the ways that we want, not just always trying to be like anarchist rebels

on the outskirts. And for somebody who just spent 5 years in prison, I thought that was a very mature

uh take. So um I'm I'm excited to see uh how he you know reintegrates into the space.

Yeah, it's very interesting take but you know like when you spend time in prison you have a lot of time to read to think and like good way good way things. So maybe that's something that helps in a way. Um and um what can you recommend some like practical actions for someone who is just getting into privacy or cy punk and just wants to do something and make it a habit or like start using some tools just from 101 perspective like easy entrance. Yeah, I think the 101 is like, you know, get your VPNs, get your anonymous crypto. Um, make sure your devices like try to secure, you know, your your devices and um try to like pay for your crypto using your pay for your VPN using anonymous crypto and then

uh be able to uh do that kind of thing to protect yourself. try to basically try to push the buttons uh of you know a couple simple services and uh start using those uh in order to to learn more. I think you can read about stuff but like using the stuff is pretty good.

Okay.

So also deposit all your ETH into privacy pools.com.

We'll cut out that.

No, no, I'm kidding.

Get one.

No, no, no, no. I'm kidding. I'm kidding.

Oh, no. No. It's all good. We are completely aligned. Yeah, it's uh they're good guys.

Yeah,

go there if you're a good guy.

Terrorists not allowed.

Yeah. Uh okay. Final take on like futuristic one. Imagine we are 30 years from now.

Yeah.

And we won. We have this internet that we imagine a private secure cyber punk whatever.

Sure.

Uh how would it look like and how would life like how would life would look like? Oh my god, I'm losing my So, how would life would how would Oh my god. Uh, so how would life look like at this techn paradise?

Uh, I'm sure it'll be, you know, an infinite garden of beautiful uh, social programmable. I don't know. Um, I think I think some things will be better uh, and some things will probably stay the same, right? like you'll have more transparency uh on the chain and so then like the questions of like how are you spending the money will like move elsewhere to the thing that doesn't have transparency uh and like you know programs will be audited and public uh but then um and like I I think it'll be cool that there will be public infrastructure that you know anybody can use but Um uh I think I mean you'll you well like okay let me let me try to answer this question differently. Uh, one of the things that I think would be really cool is if societies actually started building blockchainbased governments,

right? So, I had a, you know, kind of a troll plan which was like one day I will write the program for the constitutional monarchy of, for example, later on, right?

And I will like open up solidity and be like contract, you know, constitutional monarchy. soul function coronation ceremony address king equals new king and like then the permissions swap and you know the new king gets to like assign NFTts to his his appointed people and those give them permissions to like move certain budgets and like you can do the parliament as a you know blockchain based voting and like see how like that sort of system of record is just like open and public and it's just like a better system because you know you it's not living all in a single database and So, that really excites me. How we get there, I'm not sure, but it you you said 30 years. Maybe I don't need to figure it out.

Yes.

Um,

yeah. I want I want like the court, you know, on the chain and the court like you see the outcomes and yeah like you you have a budget and the budget's like streamed to the committee you know and like they get to choose and like a lot of the government stuff like could be improved by being on chains and um yeah like if the the reason I want to write the program for the monarch it's it's like you know you could have a king or something but like uh if they suck then like I would put a rage quit function in there uh something that's like well I can now leave the system. Maybe there's like a 20 30% exit tax, but I'm like, I'm done.

And so, uh, it's, you know, you can you can bring like blockchain ideas to like upgrade societal systems, you know, through voting, through, uh, transparency, try and solve for corruption, uh, give people voice and exit rights. I think those are pretty cool. Um, I'd like to live in that world.

Mhm. Yeah, me too. Actually, let's go. Let's go there. But how?

It's But yeah, 30 years. You said 10 years harder.

Yeah. Yeah. And uh maybe the last one um maybe you can recommend some like cultural piece like to uh exploring uh the Iranian culture. It's just like super rich and interesting and it's kind of demonized a bit in media. they self and now like the crazy thing is happening.

I'm super sorry for that as well.

Yeah. Okay.

But yeah, but I feel that there is a huge imbalance in like media weight and it would be cool if you can recommend something like for people to explore more uh this country which is kind of hidden.

Yeah, sure. Um there's uh there's a lot I mean it's a country. It's been around for thousands of years. Um, I would say if you want to know more about like sort of recent relevant geopolitics, how the Islamic Republic came to power, who was there

before that, why did you know the transition happen, what did the Iranian people want now, what's going on sort of in the last 50 years. Uh, my pinned tweet on Twitter uh is actually a great place to start. Uh I wrote a little history uh blog post uh two parts about the last uh the what the west can learn from the you know Islamic revolution in Iran because um uh politically it led to pretty bad outcome uh for the country and it was weird people working together uh that led to that kind of uh situation where it was like the very much uh communist allian and uh left like the extreme left and the extreme right which was like Islamo fascist uh people these these people have nothing in common uh except hating America and and the the sha they saw him as a puppet of the west and so they worked together to try to overthrow the the uh the sha and then as soon as they did they fought amongst themselves and the um Islamopfascists basically took power and uh Iran uh has not been you know has been an Islamic republic of Iran um for the last 45 years.

So, uh I'm Amin Soul on Twitter. So, Amel. Uh check me out. Check my pin tweet. Uh learn some more about Iranian history.

Uh I wrote I read a bunch of books so you don't have to.

Yeah. Thank you. So, thanks for coming.

Thanks for having me.

Yeah, it was a great interview. Ciao. Cheers. [Music]