Peanut Butter & Watermelon: Financial Privacy in the Digital Age

Thank you, Dan [Boneh] for that introduction. And thank you to IC3, the Center on Responsible Decentralized Intelligence, and the Stanford Center for Blockchain Research for hosting this conference. Being part of the Science of Blockchain Conference is an honor, although even the titles of most of the talks are intimidating for this non-scientist. Before I begin, I must remind you that my views are my own as a Commissioner and not necessarily those of the SEC or my fellow Commissioners.

The summer on the East Coast has been hot—so hot that, much to my surprise, I find myself craving watermelon, the quintessential summer fruit, but one for which I have a general aversion. I inherited my distaste for watermelon from my grandfather. To make it palatable, he slathered peanut butter on it—a culinary combination that attracted the attention of the neighborhood children at summer picnics. Years later, the telephone operator connecting my grandfather’s call asked, “Are you the Mr. Peirce who puts peanut butter on his watermelon?” The telephone operator had been one of the kids dismayed by my grandfather’s unconventional efforts to make watermelon edible.

That story reminds me of the value of disintermediation—not because of the watermelon and peanut butter combination—but because of the telephone operator. My grandfather’s telephone operator must have been one of the last of a dying profession; at the time he made the call in question, automated switching systems had replaced most human telephone operators. Customers could dial on their own, a task some large phone companies insisted was too hard.[1] The smaller independents, which were first to adopt the technology, noted that automation offered greater confidentiality.[2] My grandfather’s story illustrates that telephone operators sometimes were friends or neighbors of the people for whom they were placing calls. Imagine how awkward sensitive calls must have been when an operator you knew was doing the dialing. We now take for granted being able to call someone without another human in the loop.

Technology enables disintermediation to our benefit in other areas too, and the promise of additional disintermediation beckons. Cryptography, zero-knowledge proofs, smart contracts, and public blockchains facilitate the disintermediated transmission of value and information and the disintermediated coordination of human behavior. Actions that once could not be performed without centralized intermediaries now can be accomplished permissionlessly without them. A bank that might not want to lend to certain types of people gives way to a DeFi protocol through which everybody can borrow on the same, publicly transparent terms. A social media platform run by a company that might censor of its own accord or at the government’s behest is replaced by a decentralized platform that allows everybody to post content according to a universally applicable set of transparent guidelines that is known in advance and not subject to alteration or disparate application based on user content. A high-priced remittance service is exchanged for a public blockchain that allows people to move money directly and more discreetly to the intended recipient, including people disfavored by their repressive governments.

Technologies that cut out intermediaries shake up the status quo and thus sometimes inspire fear. Firms that serve as intermediaries might fear losing customers. Agencies like the SEC might fear that a disintermediated world is not regulatable because so many rules assume the presence of intermediaries whose conduct can be directed and held to account. Law-enforcement agencies that rely on centralized intermediaries for information about their customers’ involvement in potential crimes might fear that they will not be able to protect the public in a disintermediated world.

Each of these fears is understandable, but none warrants limiting the use of disintermediating technologies. Although new technology will displace some incumbents, resilient firms will use the technologies to serve their customers. Traditional financial firms, for example, might use public blockchains to make settlements and borrowing more seamless or to perform back-end functions—the so-called DeFi mullet. Disintermediating technologies can perform functions that regulations now perform, such as mitigating the risk that an entity holding a customer’s assets will steal or mismanage them, ensuring that certain conditions are met, or increasing the transparency and accessibility of services for the public. As disintermediating technologies proliferate, law-enforcement agencies will continue to prevent and prosecute crime with their sophisticated use of a wide range of technologies and information sources.

Let me pause on this last point for a few minutes. An increase in disintermediation may seem particularly daunting to law-enforcement agencies because many have come to rely heavily on the third-party doctrine, which gives them easy access to information people provide to third parties. Under current Supreme Court precedent, Fourth Amendment protections—the right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures[3]—might not apply when a person’s information is housed at a third party: law enforcement authorities can obtain the information without a warrant or notice to the affected individual. The theory underpinning this doctrine is that when a person gives information to a third party, she is indicating that she does not have an expectation of privacy with respect to the information.

A person dialing a phone himself—without a human operator—was at the center of a foundational case for the third-party doctrine. The Supreme Court, over a curt dissent,[4] affirmed its view “that a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties.”[5] It elaborated: “The switching equipment that processed those numbers is merely the modern counterpart of the operator who, in an earlier day, personally completed calls for the subscriber. . . . Petitioner concedes that if he had placed his calls through an operator, he could claim no legitimate expectation of privacy. . . . We are not inclined to hold that a different constitutional result is required because the telephone company has decided to automate.”[6] So the lack of human operators might save you from conversations about watermelons and peanut butter, but it does not save you from government surveillance. More recently, in Carpenter v. United States, the Court declined to apply the third-party doctrine to cell phone site location information,[7] but the third-party doctrine is still alive and well.[8]

The third-party doctrine is a key pillar of financial surveillance in this country, much of which occurs under the Bank Secrecy Act (“BSA”). The BSA is a nearly 55-year old law that Congress has supplemented over the years. It seeks to assist law enforcement in combatting criminal activity, including tax evasion, terrorism financing, and money laundering; protect the U.S. financial system; and safeguard the national security of the United States.[9] Under the BSA, financial institutions have to establish “reasonably designed risk-based programs” to combat money laundering and the financing of terrorism and “to facilitate the tracking of money that has been sourced through criminal activity or is intended to promote criminal or terrorist activity.”[10] The BSA defines “financial institution” expansively—the statute enumerates many entities such as banks, brokers, dealers, investment companies, insurance companies, auto and gold dealers, casinos, pawnbrokers, and travel agencies, and it authorizes Treasury to pull in additional entities.[11] Among other requirements, financial institutions must submit Suspicious Activity Reports (“SARs”) “to report any suspicious transaction relevant to a possible violation of law or regulation,”[12] and Currency Transaction Reports (“CTRs”) to report customers’ currency transactions over $10,000 individually or in the aggregate.[13] Many financial institutions also must verify their customers’ identities at account opening.[14] In fiscal year 2024, approximately 324,000 financial institutions submitted more than 25 million transactions reports, including 4.7 million SARs and 20.5 million CTRs.[15] As one observer put it, “the Bank Secrecy Act deputized American financial institutions as de facto law enforcement investigators.”[16]

Despite the profound implications of deputized financial institutions handing sensitive customer information over to government without a warrant, the BSA has withstood constitutional challenges. The Supreme Court upheld the BSA against a constitutional challenge in 1974,[17] and then again in 1976.[18] In the 1976 case, the Court explicitly embraced the third-party doctrine, and explained that the Fourth Amendment does not prohibit the government from obtaining information from a third party “even if the information is revealed [by the customer to that third party] on the assumption that it will be used only for a limited purpose and the confidence placed in this third party will not be betrayed.”[19] In both cases, strong dissents raised concerns about the third-party doctrine in the financial context. Justice Marshall proclaimed the Act “unconstitutional,”[20] and Justice Douglas observed that “[s]ince the banking transactions of an individual give a fairly accurate account of his religion, ideology, opinions, and interests, a regulation impounding them and making them automatically available to all federal investigative agencies is a sledge-hammer approach to a problem that only a delicate scalpel can manage.”[21]

The sledgehammer has become the tool of choice for monitoring for financial crimes. Banks’ ability to encrypt data gave rise to the growth of online financial services by ensuring that financial institutions could protect customer data. But as customers use online financial services, they transmit, and thereby necessarily disclose, more information to their financial institutions, which, under the third-party doctrine, is construed as acceptance by the customer that she has no expectation of privacy in the data and the data is thus outside the scope of Fourth Amendment protection. The paradox then is that banks can use encryption to protect private customer data from theft or public disclosure, but the customer nonetheless has no expectation of privacy in the encrypted data under the third-party doctrine. Financial institutions, as I noted earlier, file millions of SARs. The government has created a when-in-doubt-file dynamic. Entities the SEC regulates, for example, routinely face enforcement actions for failing to file enough SARs. As my colleague Commissioner Uyeda and I wrote in dissent to one such enforcement action in which the SEC faulted a broker for not flagging a series of transactions as suspicious, encouraging financial institutions to “see red in every flag and file unnecessary SARs . . . imposes extra costs on firms, and adds unhelpful clutter to the reporting data, making it less useful in the end.”[22]

Just as cell phone technology caused the Supreme Court to grapple anew with the third-party doctrine in Carpenter, new technology can serve as a catalyst to rethink our financial surveillance regime in the United States. A diversity of voices inside and outside government are calling for fresh thinking on the third-party doctrine, generally, and the BSA, specifically.[23] Many commentators have pointed to the ugly clash between the third-party doctrine and digital modernity. Justice Sonia Sotomayor, for example, has said that “the premise that an individual has no reasonable expectation of privacy in information voluntarily disclosed to third parties . . . is ill suited to the digital age, in which people reveal a great deal of information about themselves to third parties in the course of carrying out mundane tasks.”[24] Another commentary pointed out: “The combination of first equating ‘exposure’ with sharing in a public way and then further equating sharing with an automated third party as sharing with an individual is particularly dangerous.”[25] Stories of innocent people suffering harm because of the elaborate financial surveillance infrastructure have added to calls for rethinking the government’s approach.[26] While people appreciate the intention of the BSA, they worry about how it works in practice. Katie Haun, noting that “[e]very purchase, deposit, and transaction, from the smallest Venmo payment for a coffee to a large hospital bill, creates a data point in a system that watches you—even if you’ve done nothing wrong,” has called for a “narrow[ing]” of the BSA.[27]

Questions about the cost, usefulness, and privacy implications of the BSA make reforming the BSA a timely topic. Earlier this summer, Deputy Secretary of the Treasury Michael Faulkender, in discussing guiding principles of BSA modernization reforms, highlighted the Administration’s focus on finding the “optimal fulcrum for balancing the somewhat opposing forces of costs and benefits.”[28] In line with this commitment, the Department of Treasury recently announced its intention to delay the effective date and “revisit the substance” of a recently adopted anti-money laundering rule for investment advisers.[29] A helpful input to reform discussions would be good data about how useful information collected under the BSA is; the number of SARs and CTRs filed does not tell us whether or how they were used.[30] A recent Government Accountability Office Report suggested that the number of CTRs could be reduced without impairing law enforcement since most CTRs are not used.[31] The benefits generated by financial surveillance may not be worth the jaw dropping costs to financial institutions, their customers, and the government.[32]

But we need to ask questions that go beyond the cost to financial institutions of preparing the reports and the cost to government agencies of sifting through them. We should consider with fresh eyes whether these measures are proportionate to the threats we face and whether they diminish the liberties that make the United States a beacon for the rest of the world. Has monitoring in our financial markets placed Americans in a fishbowl that exposes private decisions about sensitive matters to public view? Has the BSA infrastructure added damaging frictions to the financial system’s ability to serve people who are not involved in criminal activity, particularly people who are not wealthy or are associated with politically or socially disfavored activities?[33] Have we forgotten the need, in the words of Supreme Court Justice Brandeis, “to be most on our guard to protect liberty when the government’s purposes are beneficent”?[34] Should we be curtailing, rather than expanding, the government’s enlistment of financial institutions to surveil their customers? Do technologies exist that can both help this country defend itself from threats at a reasonable cost and better protect Americans’ privacy?

The BSA is not the only area in need of a scalpel, instead of a sledgehammer. The government has established other programs for monitoring Americans’ financial transactions.[35] One close-to-home example is the SEC’s Consolidated Audit Trail (“CAT”), which captures customer and order event information for equities and options, across all markets, from the time of order inception through routing, cancellation, modification, or execution. Brokers must collect and send data about their customers’ activity to the CAT, where thousands of employees of the SEC and private self-regulatory organizations (“SROs”) can use it to review every person’s trading activity, without any suspicion of wrongdoing. The CAT takes the place of a more tailored system that allowed the SEC and SROs to get information on an as-needed basis. In addition to being costly,[36] the CAT disregards everyday investors’ privacy interests. Commissioner Uyeda and I consider this to be a tool “one would expect to find in a dystopian surveillance state.”[37] Other voices have raised similar concerns about the program’s implications for Americans’ privacy.[38] The CAT may be facing some long overdue rethinking. Earlier this year, the SEC stopped requiring that brokers send customers’ names, addresses, and birth years to the CAT,[39] and Chairman Atkins has called for a review of the CAT, including taking “a hard look at the reporting requirements and scope of what is collected.”[40]

As policymakers and legal scholars consider how longstanding, historic rights embodied in the Fourth Amendment apply when people interact with modern technologies operated by third parties, technologists are simultaneously working on protecting people’s privacy. Just as old technologies expanded the reach of the third-party doctrine, new technologies that eliminate intermediaries may make it less powerful. New and improved technology can diminish the need for us to rely on third parties and thus to hand our information over to them. Where, by design or deficiency, the law will not protect us, technology might. Encrypted networks and cryptographic protocols are such tools. Zero-knowledge proofs allow a person to prove who she is or something about her (such as her age) without requiring her to share her private information. Privacy pools and mixers enable a person to keep private her compensation, her donations to charity, her associations with political or religious organizations,[41] and her purchases. Decentralized physical infrastructure networks remove the centralized party from the provision of essential services and so make it harder for a repressive government to track its citizens’ movements. Some public blockchains include privacy-protection and thus enable people to do what the introduction of private phone lines did—shield sensitive information from public exposure.[42]

For these and other new technologies to be able to play a role in protecting Americans’ privacy, government must guard jealously the ability of Americans to use them freely. Such protective measures may run counter to regulatory instincts, but overcoming those instincts is crucial to maintaining the freedom and prosperity of the American people. Indeed, a series of recent events reminds us that limitations on the use of privacy-protecting tools can expose people to threats to their physical safety too.[43] Rather than something to be feared, we should embrace these tools’ ability to help humanity live freer lives without unwarranted financial surveillance. People use these tools for bad purposes too, but treating technology as the villain will impinge on legitimate users’ privacy.[44] Going after the real villains is important, but we can do so while still ensuring widespread access to fundamental American rights.

Most public servants engaged in law enforcement have dedicated their lives to protecting this country precisely because of the values this country embodies. While not perfect and not always perfectly aligned with one another, we constantly strive as a people to make this country better and to deepen our nation’s commitment to the dignity of each person. Key to a person’s dignity is her ability to decide to whom she will reveal information about herself. The people who have devoted their careers to our country’s security are well situated to appreciate the importance of their fellow Americans’ right to private, fulfilling lives. They are thus well-suited to advocate for their fellow Americans’ ability to use technologies that help them to live private, fulfilling lives.

The past offers us an important lesson. In the 1990s, governments, for national security reasons, wanted to keep strong cryptography out of private hands. The internet could not have succeeded without strong cryptography, so a determined set of cryptographers pushed back and convinced the government that cryptography in private hands was a net positive.[45] Because of their hard-fought victory in the courts and the court of public opinion, we daily rely on encryption to send email, engage in online banking, buy from online merchants, communicate with one another through voice and video, and conduct many other daily tasks. One of those cryptographers, Phil Zimmermann—developer of Pretty Good Privacy (PGP) encryption software—recently made the case for a renewed effort to protect individuals’ right to use end-to-end encryption in their communications, in light of vastly expanded accessibility of these tools to the general population.[46] He argues that for personal privacy and national security reasons, protection of strong, backdoorless end-to-end encryption is essential, and governments of free people should defend the right of private citizens to use it so they can protect themselves in a world replete with bad actors.[47]

We should take concrete steps to protect people’s ability not only to communicate privately, but to transfer value privately, as they could have done with physical coins in the days in which the Fourth Amendment was crafted. A recent President’s Working Group included the following pertinent recommendation: “American citizens and businesses should be able to own digital assets and use blockchain technologies for lawful purposes without fear of prosecution. Likewise, American entrepreneurs and software developers should have the liberty, and regulatory certainty, to upgrade all sectors of our economy using these technologies.”[48] As that recommendation suggests, we should welcome privacy-protecting technologies and safeguard the right of individuals to self-custody their crypto assets. And developers of open-source privacy software should not have to answer for the actions that other people take using the software they wrote. Although a centralized intermediary or even a DAO deploying a DeFi application could build in restrictions on its use, an immutable, open-source protocol is available for anyone’s use in perpetuity, so requiring that it comply with financial surveillance measures is fruitless. [49] We should not ask peers transacting with one another, where no intermediary exists, to collect and report information on each other.[50] Doing so would deputize us to surveil our neighbors—a practice antithetical to a free society. Nor should we require an intermediary to step in the middle of peer-to-peer transactions. SEC Chairman Atkins urged in a recent speech that we need to create a regulatory “path for software developers to unleash on-chain software systems that do not require operation by any central intermediary” and avoid “interpos[ing] intermediaries for the sake of forcing intermediation where the markets can function without them.”[51] As with the internet, technologies that have legitimate uses are better left in the permissionless, available-for-all-to-use category, even though doing so enables people to use them for bad purposes, because taking any other course would impinge fundamental liberties.

Restoring Americans’ privacy in their financial transactions will be an uphill battle. Eric Hughes, who studied mathematics here at Berkeley and wrote A Cypherpunk’s Manifesto observed, “We cannot expect governments, corporations, or other large, faceless organizations to grant us privacy out of their beneficence.”[52] And sometimes We the People are pretty stingy, too, when it comes to privacy. Whenever I publicly raise concerns about the expansion of financial surveillance, someone says something along these lines, “I have nothing to hide. It is wonderful that law enforcement is watching everyone’s financial transactions so that it can get the bad guys.” They often suspiciously follow that statement with: “Why are you, a regulator, advocating less surveillance?” Privacy scholar Daniel Solove has explained, the “nothing-to-hide” argument “represents a singular and narrow way of conceiving of privacy, and it wins by excluding consideration of the other problems often raised in government surveillance and data mining programs.”[53] The surveillance-is-fine-with-me attitude may reflect a “condition[ing]” of the American people by “influences alien to well-recognized Fourth Amendment freedoms.”[54] People may have gotten so used to a world swallowed by the third-party doctrine and the financial surveillance apparatus that has grown out of it that they have no expectation of freedom from government surveillance of their financial lives. On the other hand, according to one survey, 83 percent of respondents agreed that the government should need a warrant to access financial records, and 79 percent thought it unreasonable for a bank to share a customer’s records with the government.[55] Those statistics give me hope that even deep-rooted policies and common practices can change.

Most fears of financial privacy and the technology that enables it flow from a genuine desire to protect this nation from enemies and criminals. Safeguarding our families, communities, and country from harm is extremely important, but curtailing financial privacy and impeding disintermediating technologies are the wrong approach. Denying people financial privacy—whether through sweeping surveillance programs or restrictions on privacy-protecting technologies—undermines the fabric and freedoms of our families, communities, and nation. The American people and their government should guard zealously people’s right to live private lives and to use technologies that enable them to do so.

I will close by wishing you a belated Happy Watermelon Day. If you forgot to celebrate yesterday, have a slice today, but make sure you have a jar of peanut butter close at hand.