Bitcoin has been a popular buzz word for the last couple of years. People have written several articles on the topic, created documentaries to explain how it works, and some have even ventured out to dabble in the exchange. While we all seem to have a vague understanding of this currency, are we certain courts will interpret our value of the currency the same? Is the currency equivalent to money?  The courts are getting closer to providing answers to these questions.

The United State District Court in the Southern District of Florida recently explored these questions in Ira Kleiman, et al. v. Craig Wright, 2018 WL 681294. The case involves two individuals, David Kleiman (“Dave”) and Craig Wright (“Craig”), who worked together in developing Bitcoin and through their collaboration mined over a million bitcoins. Id. at 1. The court defined bitcoin as a “decentralized digital currency that uses a ledger to track the ownership and transfer of every bitcoin in existence.” Id. The court continued to explain, “[t]his ledger is called the ‘Bitcoin Blockchain’. In order to complete a transaction with bitcoins, you must have a bitcoin wallet. Wallets are computer files dedicated to storing information.” Id.

In February 2011, Dave formed W&K Info Defense Research LLC (“W&K”). While, the Articles of Incorporation for W&K listed Dave as the managing member and registered agent, the company had no operating agreement that identified its exact ownership structure. Id. at 2. Dave created intellectual property for W&K in his individual capacity and in partnership with Craig. Id. Dave Kleiman passed away in April of 2013. Id. A suit was filed after Dave’s death by his brother and personal representative of his estate, Ira Kleiman (“Plaintiff”), against Craig. The complaint alleged “Craig unlawfully and without permission took control of the bitcoins from [Dave’s estate] and from W&K once he had exclusive possession over the private keys that Dave and Craig shared to move the bitcoins out of their wallets and then claimed to own bitcoins really owned by W&K and/or Dave by creating a series of fraudulent contracts and documents.” Id.

Craig moved to dismiss the complaint on several grounds including failure to state a legally sufficient claim for conversion. Id. at 4. The court notes the definition of conversion under Florida Law is “the wrongful exercise of dominion or control over property to the detriment of the rights of one entitled to possession.” Id. at 15. The elements of conversion include: 1) a specific and identifiable money; 2) possession or an immediate right to possess that money; 3) an unauthorized act which deprives plaintiff of that money; and 4) a demand for return of the money and a refusal to do so. Id. at 15.  While Craig argued bitcoin was a legitimate currency, the Plaintiffs argued that bitcoin was not money but rather a commodity. Id. at 14. In this evaluation, the court notes that the Eleventh Circuit Court of Appeals had yet to decide whether bitcoin is considered money in a civil context. Id. at 15. However, the court identified other jurisdictions have found bitcoin qualified as legitimate currency for purposes of indicting and prosecuting a defendant on federal money laundering statutes. Id. at 15.

While the Kleiman Court does not directly address whether bitcoin is money, the Court adopts the interpretation from other jurisdictions and focused its analysis of conversion on the specificity and identifiable nature of the money. Id. at 15. The court states, “[w]hether or not bitcoin is ‘money’ for the purposes of a conversion claim,” the Plaintiffs have sufficiently alleged a claim for conversion. Id. The court notes “every bitcoin wallet and the number of bitcoin inside that particular wallet can be identified on the blockchain.” Id. at 15. Additionally, the plaintiffs state the bitcoin at issue was stored in a specifically identifiable bitcoin wallet and the defendant admitted that Dave owned at least 300,000 of the 1,000,000+ held in the trust. Id. at 15. Since the court deemed the bitcoin was specific and identifiable money, the claim for conversion survived the motion to dismiss. Id. at 16.

The insurance industry should pay close attention to these cases addressing whether bitcoin is a legitimate currency in order to monitor the unique insurance claims presented by technology.  That is, we can expect insureds to seek insurance coverage to safeguard their bitcoin holdings as this becomes a more legitimate currency.

The post Is Bitcoin Legitimate Currency? The Courts Seem To Think So appeared first on Privacy Risk Report.

Unfortunately, the law governing cyber security and privacy issues has not kept pace with the technology giving rise to these issues.   However, a recent decision applying existing law to Bitcoin and other virtual currencies provides insight on how we may expect the law controlling cyber security and privacy law to develop.

In Commodity Futures Trading Commission v. McDonnell, 2018 WL 1175156 (March 6, 2018), the District Court for the Eastern District of New York held the Commodity Futures Trading Commission (“CFTC”) “has standing to exercise its enforcement power over fraud related to virtual currencies sold in interstate commerce…”  The CFTC is tasked with stopping fraud or manipulation in derivatives markets by enforcing the Commodity Exchange Act (“CEA”).  The CEA requires “any commodity traded as a future” to be “traded on a commodity exchange approved by the CFTC.  Title 7 U.S.C. § 2.  In McDonnell, the threshold question was whether virtual currency may be regulated by the CFTC as a commodity.  And, after a lengthy analysis of virtual currencies, the District Court held the CFTC had authority over these markets and was entitled to enjoin the defendants from continuing to sell virtual currencies to the public.

The facts underpinning the McDonnell decision involve allegations that the Defendant, Patrick McDonnell (“McDonnell”), and his investment companies, “offered fraudulent trading and investment services related to virtual currency.”  Specifically, “[c]ustomers from the United States and abroad paid defendants for ‘membership’ in virtual currency trading groups purported to provide exit prices and profits of up to ‘300%’ per week.”  Unfortunately, the defendants disappeared by deleting company social media accounts and ceasing all communications with investors after receiving the initial payment and subsequent investments from members.

After hearing evidence concerning the defendants’ actions, the District Court granted a preliminary injunction to the CFTC when it found that the defendants committed fraud through false trading advice and “promised future profits.”  The District Court held that an injunction was warranted in light of the reasonable likelihood that the defendants would continue to violate the CEA.

• Virtual Currencies Are Here To Stay

Before arriving at its decision, the McDonnell Court conducts an in-depth analysis of Bitcoin and other virtual currencies.  After addressing the basics related to virtual currencies, the District Court  finds these currencies “serve the same purposes as gold in terms of a currency, but much more efficiently because it does not have any mass and can be sent easily from place to place.”  Further, the District Court acknowledges that virtual currencies may be here to stay because “online exchanges have become more accessible allowing more members of the public to trade and invest in virtual currencies.”  The District Court concludes there is a greater chance for fraud and criminal activity as these currencies grow in popularity.

• While The Regulations Are Slightly Unclear, There Is No Doubt That Virtual Currencies Are Regulated By Some Governmental Agency.

After taking a closer look at how virtual currencies could potentially be regulated by the Department of Justice, the Security and Exchange Commission, the Treasury Department, the IRS, private exchanges or through state regulations, the District Court settles on the CFTC as the administrative body that is “currently exercising partial supervision of virtual currencies.”  The District Court’s analysis of these regulations provides further support for the finding that the CFTC has standing to seek injunctive relief against anyone violating the CEA.

• Virtual Currencies Are “Commodities” That Can Be Regulated By The CFTC

The McDonnell court must also address whether virtual currencies are “Commodities” as defined under the CEA. Therefore, the District Court must analyze whether virtual currencies fall within the definition of Commodities as defined in the CEA which protects agricultural products and all other goods and articles…and all services, rights, and interests…in which contracts for future delivery are presently or in the future dealt in.”  After a lengthy analysis of this issue, the District Court ultimately concludes “[v]irtual currencies can be regulated by CFTC as a commodity.”  In short, the District Court finds “[v]irtual currencies are ‘goods’ exchanged in a market for a uniform quality and value.”

• The CFTC Is Entitled To An Injunction When The Fraud Is Not Directly Related To The Sale Of Futures Or Derivative Contracts

After finding the CFTC has standing to seek an injunction against the defendants, the McDonnell court next determines there is sufficient evidence that the defendants “committed fraud by misappropriation of investors’ funds and misrepresentation of trading advice and future profits promised to customers.”  On this issue, the District Court concluded that a preliminary injunction in favor of the CFTC was warranted in light of the finding that a fraud had been committed.

• The Scope Of This Decision May Reach Beyond Virtual Currencies

First, the McDonnell decision makes clear that it is time for insurers to start considering whether virtual currency presents losses covered under traditional insurance policies or if new products should be developed.  Over the last few months we have seen more people invest in virtual currencies.  The McDonnell court quotes the December 1, 2017 Bloomberg Businessweek which sheds more light on virtual currencies: “The initial price of bitcoin, set in 2010, was less than 1 cent.  Now it’s crossed $16,000.  Once seen as the province of nerds, libertarians and drug dealers, bitcoin today is drawing millions of dollars from hedge funds.”  (While the price in December 2017 was $16,000, the price has since dropped). The McDonnell decision acknowledges that as the pool of investors increase, we can expect to see an increase in the potential for losses, theft and all the other things the defendants in this case are accused of doing.  Consequently, as virtual currencies become more ingrained in our daily lives, it may be time for insurers to start taking a closer look at losses involving virtual currencies.

Additionally, the McDonnell decision discusses a number of issues currently facing cyber and privacy law.  First, while the District Court finds virtual currencies fall into the definition of “commodities,” the Court has to work to get there.  In the end, the District Court finds that the same law can protect agricultural products and virtual currencies at the same time.  We face many of these same issues in cyber security and privacy law as we try to fit these emerging issues into laws and regulations that may have been on the books for decades.

Finally, the section of the McDonnell decision entitled “concurrent oversight from Other Agencies” discusses how a number of governmental agencies could regulate virtual currencies.  Likewise, cyber security and privacy faces a similar situation as a number of state and federal agencies fight to regulate this emerging area of law. Therefore, while the McDonnell decision provides insight into the regulation of virtual currencies, it also provides guidance for cyber security and privacy law.

The post Court Finds Virtual Currencies Are “Commodities” Subject To Existing Laws appeared first on Privacy Risk Report.

On September 15, 2015, Bitpay, Inc. filed a lawsuit against its insurer, Massachusetts Bay Insurance Company, related to a hack at the company that resulted in an unauthorized transfer of bitcoin valued at more than $1.8 million. In its Complaint filed in Atlanta, Bitpay refers to itself as a “global bitcoin payment processor.” Bitpay’s Complaint and other reports provide the following timeline related to the alleged unauthorized transfer:

• On December 11, 2014, Bitpay’s CFO received an e-mail from a hacker claiming to be David Bailey with yBitcoin, a digital currency publication, asking the CFO to comment on a document.
• Unfortunately, the email to Bitpay’s CFO was sent by an unknown person that had hacked Mr. Bailey’s e-mail account.
• By following instructions provided in the hacker’s fake e-mail from Bailey, Bitpay’s CFO ended up providing his e-mail credentials to the hacker.
• After having the CFO’s e-mail credentials, the hacker gained access to the CFO’s computer, reviewed the CFO’s e-mails to learn how transfers were made within the company.
• Bitcoins were transferred when Bitpay’s CEO received e-mails that appeared to be from the CFO requesting bitcoins from customers’ “digital wallets.” As he had done on many occasions, the CEO made the transfers as requested by CFO.
• On one transfer the CEO copied Bitpay’s customer on the e-mail confirming the purchase of bitcoins and the customer sent an e-mail back that they did not purchase the bitcoins.

The Complaint alleges that after investigating the claim, Massachusetts Bay denied Bitpay’s claim for coverage. Bitpay’s lawsuit seeks damages based on a claim for breach of contract and bad faith under Georgia law. Bitpay attached a copy of Massachusetts Bay’s denial letter to its Complaint which states, in part, the following reason for denial of Bitpay’s claim for coverage:

As noted in Insuring Agreement 6 cited above, the Policy requires that the loss of money be the direct result of the use of any computer to fraudulently cause a transfer of that property from inside the premises to a person or place outside the premises. “Direct” means without any intervening step i.e. without any intruding or diverting factor. The Computer Fraud Insuring Agreement is only triggered by situations where an unauthorized user hacks into or gains unauthorized access into your computer system and uses that access to fraudulently cause a transfer of Money to an outside person or place. The facts as presented do not support a direct loss since there was not a hacking or unauthorized entry into Bitpay’s computer system fraudulently causing a transfer of Money. Instead, the computer system of David Bailey, Bitpay’s business partner, was compromised resulting in fictitious e-mails being received by Bitpay. The Policy does not afford coverage for indirect losses caused by a hacking into the computer system of someone other than the insured.

Furthermore, there is an important distinction between fraudulently causing a transfer, as the Policy language requires, and causing a fraudulent transfer, which is what occurred upon the CEO’s approval of the bitcoin transactions after receiving the fictitious e-mails. The loss incurred by Bitpay was not a direct loss.

While the insurance policy at issue in the Bitpay litigation was a Commercial Crime Policy and not a cyber insurance policy, this case still serves as an example of the unique insurance claims presented by technology. Just a few years ago there was virtually no market for insurance coverage for bitcoin operations. Further, as this technology progresses a certain amount of confusion is expected. For example, based on the allegations in Bitpay’s Complaint, some technology commentators have questioned the value of cyber insurance based on Massachusetts Bay’s denial under a Commercial Crime Policy. (See “Cyber insurance rejects claim after BitPay lost $1.8 million in phishing attack“). Whether there is coverage under this policy will be determined by the court. However, while this case is worth monitoring, the court’s determination on the Commercial Crime Policy should not necessarily be used to determine the value of cyber insurance.

The post Bitcoin Hack Triggers Litigation Under Commercial Crime Policy appeared first on Privacy Risk Report.