ABOVE: Nicolas Maduro

Yesterday the White House issued an executive order prohibiting U.S. persons from transactions in the Petro, the new Venezuelan digital currency. As you might recall, OFAC initially suggested that dealings in the Petro would violate restrictions on providing debt financing to the Venezuelan government, an idea that I said was a foolish misunderstanding of the difference between debt and currency.

The new executive order does what it should have done to begin with: restrict the digital currency directly. Of course, as the only current and guaranteed use for the Petro is to pay Venezuelan taxes and government fees, it is doubtful that the Petro will be of interest to U.S. persons and, as a result, it is hard to see that the new executive order will have much impact, other than, I suppose, preventing U.S. persons  or persons in the U.S. from operating nodes in the P2P network for the Petro.

In addition to banning U.S. persons, the new order gave OFAC the opportunity to wade into digital currencies again and shows fundamental misconceptions about how digital currencies work. Astonishingly, the new FAQs on digital currencies issued with the executive order propose to add digital currency addresses as identifiers on the SDN List:

To strengthen our efforts to combat the illicit use of digital currency transactions under our existing authorities, OFAC may include as identifiers on the SDN List specific digital currency addresses associated with blocked persons.

Oh. My. Goodness. They really said that. Next OFAC will be adding an SDN’s favorite unicorn name as identifiers on the SDN List.

Here’s what’s wrong with this idea of using  digital currency addresses as identifiers on the SDN List: they are only used once (unless you’re particularly clueless). For each payment request, the requester generates a unique public and private key pair. The digital address is a hash of that key pair. The payment request is signed with the private key and sent with the public key, allowing the authentication of the request. When the individual wants to make another payment request, a new key pair and address is generated.

So, if OFAC puts an address on the list, hoping to prevent U.S. persons from sending digital currency to that address, it is a waste of time because it is highly unlikely that address will ever be used again for a payment request (particularly once the address is on the SDN List). Nor will it prevent U.S. persons from receiving money from that address, because  the digital currency can be transferred to a newly-generated address prior to sending the currency. (And this problem is not solved by looking at the last-sent-to address in a blockchain explorer, because that will not establish that the new address is controlled by the same, presumably blocked person. If sent by the blocked person to an address of an unblocked person, the transferred digital currency is no longer blocked because the blocked person no longer has any interest in it.)

Of course, in the unlikely event that the SDN is not savvy enough to use a different address for all of his/her digital currency transactions (or to use wallet software preventing address reuse), then he will get caught by listing his reused address as an identifier. But, I’m guessing the only people re-using the same address for all their digital currency transactions are working at OFAC.