Electronic Frontier Foundation Calls out Coinbase on Privacy

In at least one key way, cryptocurrency exchanges are exactly like banks: Americans who use them can have their information turned over to government agencies without a warrant.

The Electronic Frontier Foundation (EFF), a privacy-centric civil liberties group, has had enough of that, so it's looking for cryptocurrency exchanges—whose users often prize crypto's anonymity and censorship-resistance—to push back.

Today, it called on Coinbase to release regular transparency reports detailing government requests for user information—and how the exchange responds.

"EFF has become increasingly concerned that payment processors are being asked to turn over information on their customers, without any mechanism for the public to know who is making those requests, or how often," Haley Tsukayama wrote in an EFF blog post today.

She continued: "In providing the public with data on how often law enforcement seek user data and how often services comply, transparency reports show whether companies are living up to their promises to protect user privacy."

In EFF's view, Coinbase has, at least on one occasion, not protected user privacy.

It points to the exchange's role in providing information to federal law enforcement as part of an investigation into a child pornography site that took payments in Bitcoin.

In that case, the federal government subpoenaed Coinbase for details on any users who had sent Bitcoin to any account associated with the site. Coinbase pointed agents to a customer named Richard Gratkowski. Law enforcement used that information to obtain a search warrant for his house, where they allegedly found a hard drive with illegal porn.

Although they obtained a warrant to search Gratkowski's house, federal agents did not serve a warrant to Coinbase, meaning the subpoena request wasn't approved by a judge. As EFF notes, they didn't have to. A district court ruled that Gratkowski, as a cryptocurrency exchange user, lacked a reasonable expectation of privacy.

In upholding that decision, the Fifth Circuit Court of Appeals concluded:

"Bitcoin users have the option to maintain a high level of privacy by transacting without a third-party intermediary. But that requires technical expertise, so Bitcoin users may elect to sacrifice some privacy by transacting through an intermediary such as Coinbase."

In other words, when users turn over their financial data to a third party—whether it's a bank, cryptocurrency exchange, or another financial institution—their transactions are no longer necessarily private. Not your keys, not your Constitutional right to privacy.

EFF thinks the ruling "makes no sense in a world where everyone navigates through their daily life by relying on services such as email that provide third parties with access to sensitive information."

EFF stops short of faulting Coinbase for handing over information in the Gratkowski case. Instead, it wants to know how often such requests happen and how Coinbase decides whether or not to comply.

Notably, rival exchange Kraken releases a transparency report at the end of the year detailing how many requests it gets from law enforcement, including the country, agency, and location of the account holder.

Picking on Coinbase is something of a strategic decision as EFF wades into the crypto waters and appeals to users' basic expectation of privacy.

"As one of the largest individual companies in the U.S. cryptocurrency market, Coinbase wields tremendous power and influence over this dynamic," Tsukayama wrote. "It should stand up for its users and also use its market power and influence to show others that transparency reports are an industry standard for all cryptocurrency exchanges."

(Coinbase has not yet responded to a request for comment.)