Free software and fiduciary duty

He claims he was storing billions of dollars worth of Bitcoin-- which he claims belongs to a trust for the benefit of his family-- on his desktop with no backups and that intruders broke into his home to plant a "wifi pineapple" to break into his computer where he presumes they copied the data. He claims they they deleted the data from the computer and the MSFT cloud storage connected to the computer and that when he discovered the compromise he wiped the computer completely to be sure that the compromise was cleared, helpfully destroying any evidence of the hack and making any recovery of deleted files even harder. He then made no attempt to recover the data from the cloud storage (even though it should be recoverable for at least 30 days).

He then waited six months and had his trust filed a lawsuit against a dozen free software devs who currently or previously had contributed to Bitcoin-- software he claims to have been the original author and designer of--, alleging that they have a fiduciary duty to users of the software (and him specifically) to write functionality (a backdoor) to allow parties who lost their coins to recover them and that because they haven't done so they were already in breach of this duty and liable for billions of dollars in damages.

The bitcoins in question haven't moved since 2011. (The entity, a seychelle shell corp that supposedly owns them was purchased by him off a list of preformed companies in (IIRC) 2014.) Of the 111k BTC 80k of them are the unmoved coins stolen from the MTGox exchange, well known to most people long before Wright showed up. The reason he's claiming to own them is that in 2014 the AU tax office nailed him for some tax credit fraud where he needed to prove he could have spent money on R&D and he appeared to have picked 5 addresses at random off a bitcoin rich address list. AU concluded that he was full of crap and found against him. After this came out the owners of several of those addresses came out and made statements (including a digitally signed message using one of the addresses) saying that their coins weren't Wright's. For this lawsuit Wright claimed to own two of the addresses that hadn't published such statements-- presumably because it was obvious that their owners weren't going to speak up. Of course, when the defendants asked for a copy of a police report they were told it wasn't any of their business.

So: The coins were obviously never his and weren't stolen in 2020. If they had been stolen from him it would have been substantially due to his own negligence, including keeping them online, not having backups, and not attempting to recover from the cloud provider (and so the trust should be suing him; the police should also be asking how he had possession of billions of dollars worth of stolen mtgox coins). Ignoring that, if it could be said that there is some fault in Bitcoin that fault would be a consequence of the creator's design decisions, as Satoshi said: “Lost coins only make everyone else's coins worth slightly more. Think of it as a donation to everyone.” -- and, of course, Wright claims to *be* Satoshi though only people who know nothing about this stuff think isn't laughable, esp since all the 'proof' he's put up has been shown to be forgeries or nonsense.

But for some reason the UK courts think that this fairy tail is a reasonable enough justification for individual volunteer developers, some of whom-- like me!-- haven't worked on bitcoin for many years, to face millions of dollars of legal costs under a potential threat of billions of dollars in damages and potential imprisonment.

The cost of taking this to trial will be many millions of dollars.

If the defendants run out of funding along the way they will lose. Assuming they don't and they win, they still lose: In the UK the loser pays motion by motion, but usually only 70% (and even that diminished by earlier arguments that you weren't successful with). That might sound good until you realize that if you're on the hook for 10 million in trial costs and only recover 70%-- that would still leave most ordinary individual defendants completely bankrupt. All on account of contributing to some free software without remuneration.

We're extraordinarily fortunate to have sponsorship from the Bitcoin community for the time being-- though it can't be guaranteed to continue because there is no bound on the upper cost to the trial or the number of additional cases he can file (and, in fact, he's just filed a second lawsuit). This isn't merely a hypothetical, for example a journalist/podcaster that Wright sued was forced to abandon his defense mid-trial as a result of his sponsorship running out when he hit a million GBP in legal costs. But our good fortune this is a bit of historical accident, not a guarantee... and someone else in a similar situation might not be so fortunate.

Because of this, as an individual the outcome of going to trial is easily lose/lose: you're bankrupt regardless of if you win or lose. The plaintiff in this case was well away of this, bragging on social media long before filing the case that his goal was to ruin the defendants financially and destroy their families and that they would either way by the costs of the case. Because of this *it's* critical that free software authors have the greatest chance possible of being able to discharge spurious claims on a summary basis: after there isn't income from the work that would allow for absorbing legal costs as a "cost of doing business". If you can't discharge spurious legal attacks on a summary basis, -- then participating in the first place is a bad idea.

Going back to the article,

> The appeals-court ruling, though, makes no mention of warranties.

It's an error to read the appeals decision in isolation however, as it's effectively a diff of the lower court decision, where the subject is addressed https://www.bailii.org/ew/cases/EWHC/Ch/2022/667.html

It didn't arise in the appeal because that point wasn't being appealed. The original decision was made on the basis that this would just be a contrived application of fiduciary duties in the abstract. Unsurprising, it's not like you can allege that thieves stole a billion dollars from you and now the federal reserve has a duty to void the stolen bills by serial number and print you new bills. :) Positives duties are quite rare in the law, even a police officer holding a rope that could save your life as you fell off a cliff is not obligated to hand it to you.

> In other words, it is not the software license that might possibly create an obligation here.

Indeed, it doesn't create it but I would argue that it failed to disclaim it effectively enough.

Since the plaintiff claims to have used the system by way of the MIT (expat) licensed software written by the defendants (and the owner of the plaintiff actually redistributes that software) and the software formed the only basis of connection between the parties, I think there clearly was an opportunity to have more forcefully protected from this outcome: The trial court wrote, "It is true that the disclaimer is in broad terms, but it is not clear to me that it would reasonably be understood to mean that controllers of the BTC Network assume no responsibility for any aspect of its operation." but of course that *is* the intent, because who would publish their work for free to the world if it meant taking on potentially millions of dollars in liability for other peoples errors? We certainly wouldn't have.

So I agree with Corbet on the court's fundamental misunderstanding-- but that "misunderstanding" was very likely at this juncture by virtue of this being a summary determination: the court was constrained to find the facts in the plaintiff's favor. It wouldn't have been impossible for them to be wise enough to the free software to see through his control allegation, but in this case they weren't. But even in the (untrue) hypothetical world where the imagined control actually did exist, we would have expected the license we offered (and the plaintiff accepted) to form a serious shield against these claims.

Now, if that could be clarified while also staying within the norms of open source software or if doing so would be of general benefit (rather than just helping with this particularly weird case) I'm less sure of.

Okay, they pretty much certainly won't get everything back, but a large chunk of it ...

Cheers,
Wol

Instead of saying "all" I think it's probably better to not privilege one version vs another. Instead it's better to say that when there are irreconcilable incompatibilities in the consensus rules that the participants will form a network only with those participants they're compatible with. So by definition "all" the users in each of two resulting systems would have applied that system's rules, but its more clear that the "all" applies within the subset.

So the any change implementing such an incompatibility will only have a direct effect on the parties that run it. If someone were to run publish a version with a backdoor for Wright then any people (who? lol) who ran it would see Wright with those coins and anyone who didn't wouldn't and the result would be two distinctive currencies.

Now, you and I both believe that the non-backdoored version would be the legitimate one and the backdoored version is a joke that essentially no one would adopt or care about (just like Wright's existing alternative version "Bitcoin SV")-- but that's just our (informed) opinion and not itself a consequence of how the system operates, it's just a consequence of the change being obviously bad.

And then as you say you get into questions like economic majorities: In this example any user could participate in either or the sets of rules (or both, if they like) but that's only considering them in isolation. Money like goods get their value from network effect, so if you're alone in whatever rule's you're on the whole thing won't be very useful to you.

Due to Bitcoin being free software software engineers don't have control over what the software people are running is doing but they especially don't control public opinion... except to the extent that they have a good reputation and could make a compelling argument on logical grounds that persuaded people. But I think even the UK courts are not derranged enough to try to order someone to shill in favor of some conman's heist attempt. :)

It seems very naïve to operate a massive global financial/economic service and expect to not be in some form accountable for it. (Not being held accountable for their economic actions is the domain of billionaires and governments.) Finance is generally a fairly regulated space.

This seems similar to https://www.schneier.com/blog/archives/2021/03/illegal-co... in a way: taxation, liability, climate regulations, national interests, and illegal data in the chain might eventually add up to force a regulatory crack down.

They think a case in the UK is bad? Wait until someone brings a class action law suit in the US with their specific take on damages and juries.

This is why this is already a serious blow to free software: if we can't get a case dismissed on a summary basis even when the plaintiff is a transparently obvious conman who's been adjudicated in multiple courts to have perjured himself and forged evidence-- then it's just not safe to participate at all.