Bitcoin as property
In the case of AA1, bitcoin was paid by an English insurer, the insurer of a Canadian insurance company, as a ransom, in return for decryption software following a malware encryption cyberattack.
The insurer hired consultants who tracked the bitcoin payments to a specific address linked to the cryptocurrency exchange Bitfinex. As 96 bitcoins remained in the located account, the insurer sought an interim proprietary injunction to secure the bitcoins as the insurer’s property.
The court had to consider whether the cryptocurrency constituted a form of property capable of forming the subject matter of an injunction. The difficulty for the judge (Bryan J) was that traditionally English case law identifies property as either a ‘thing in possession’ or a ‘thing in action’. Cryptocurrencies cannot be ‘things in possession’, as they are intangible and cannot be possessed due to their virtual nature. They, additionally, cannot be defined as ‘things in action’ as they do not embody any right capable of being enforced by action.
However, Bryan J was able to rely on the thoughtful analysis of the UK Jurisdiction Taskforce’s recent legal statement2 and adopted its pragmatic and sensible conclusion that while a cryptocurrency might not be a ‘thing in action’, that did not mean it could not be treated as property. He concluded on a preliminary basis that a cryptocurrency would meet the four classic criteria for property set out by Lord Wilberforce in National Provincial Bank v. Ainsworth,3 namely, that it was (i) definable; (ii) identifiable by third parties; (iii) capable by its nature of assumption by third parties; and (iv) capable of some degree of permanence.
Therefore, Bryan J was satisfied that, at least for purposes of an application for interim relief, bitcoin constituted property and was capable of being the subject of a proprietary injunction. The English courts deliberated on this issue previously in two cases4 but not in such a considered way and with the benefit of the taskforce’s conclusions. The approach of Bryan J is significant, not just for the result but also for the manner in which he adapted existing legal rules to new technology and was prepared to take guidance from the taskforce’s conclusions.
The global context - the next frontier
The case also raises some wider issues relating to the ability of a party to obtain suitable remedies in the context of cryptocurrency transactions that operate on a transnational basis.
The insurer was able to trace some of the bitcoin directly and take action to protect it. However, sometimes a victim of cyber fraud will first need information from a cryptocurrency exchange before it can progress its claim (e.g., to identify the account holders). If so, the first application that the victim of a cyber-fraud attack will probably need to make is for a Norwich Pharmacal order (NPO), which requires the respondent to disclose certain documents or information to the applicant.
In AA, the insurer requested that the court grant an NPO against the exchange for information to help it identify the perpetrators and trace some funds which they had already converted from bitcoin into fiat currency. However, as is often the case, the exchange was registered outside of a mainstream jurisdiction, in this case in the BVI. This presents two substantial obstacles for the victim under English law:
- Where the exchange must be served outside the jurisdiction, previous Commercial Court authority (Abu Dhabi)5 suggests that the court only has jurisdiction to grant an NPO if the respondent is a “necessary or proper party”6 to the claim. In cryptocurrency terms this means establishing a claim against the exchange so it becomes a party to the action.
- Most overseas entities will refuse to comply with an English disclosure order unless and until that order is recognised, or similar relief is obtained, in the relevant local jurisdiction.
The court in AA followed Abu Dhabi and decided that the claimant had not been able to formulate a legal cause of action against the exchange and so adjourned the NPO application until the claimant restated its case.
This might not be an easy task given: (i) the potential difficulty in establishing a case against an exchange if it is only involved in processing a transaction on an arm’s length basis and (ii) the traditional English law remedy of conversion prohibits claims against intangible assets.7 Unless the court is willing to re-examine the jurisdictional basis of NPOs, this could represent a barrier to the progression of future claims.
Other international issues
Similar international issues are evident from the case or discussed in the taskforce’s legal statement:
- The insurer had paid the ransom in England, which enabled the court to conclude that it could take jurisdiction over the proprietary injunction. However, the attraction of a cryptocurrency as a conduit for fraud is that it exists across frontiers. In other cases the court may find it difficult to identify the place of damage and the correct jurisdiction.
- As noted by the taskforce, legal systems will need to resolve what law should be applied where there is a dispute regarding the ownership of the cryptocurrency (for example, due to an off-chain transfer or where security has been granted over the cryptocurrency).
In order to resolve similar issues, the courts may need to continue the approach of adapting existing principles to the new concepts involved in cryptocurrency. Global cooperation may assist in developing common standards and a uniform approach (for example, to the disclosure of information). In the meantime, victims of cyber fraud should take multi-jurisdictional advice to ensure they can access appropriate remedies and utilise jurisdictions that are adapting their law quickly to new technology.
Conclusion
This decision has far-reaching consequences for companies and financial institutions, as well as their insurers, when faced with cyber threats. The recognition and application of the taskforce’s legal statement and the recognition of cryptocurrencies as property under English law have provided greater certainty for investors and users as to legal rights relating to the ownership, transfer and use of cryptocurrencies.
The availability of interim relief, such as injunctions, in the event of misappropriation of cryptocurrencies is a welcome development; however, obtaining an injunction in parallel to asset tracing payments is likely to be a cost-intensive step with potential difficulty in enforcing the injunction. This case does demonstrate that there may be a chance of recovery if the value of the cryptocurrency involved is significant enough, if it can be traced and it is possible to act quickly. It is unknown whether domestic and international legislation will be introduced to further strengthen the legal framework around cryptocurrency in response to the increasing use (and abuse) of such assets globally, and to resolve the wider issues.
- AA v. Person Unknown [2019] EWHC 2556 (Comm)
- A review of the legal basis of cryptocurrencies was conducted by leading academics and practitioners as members of the LawTech Delivery Panel of the Law Society.
- [1965] AC 1175.
- Vorotyntseva v. Money-4 Limited [2018] EWHC 2596 (CH). Robertson v. Persons Unknown (unreported).
- AB Bank Ltd v. Abu Dhabi Commercial Bank PJSC [2016] EWHC 2082 (Comm).
- Ibid para 19.
- OBG v. Allan [2007] UKHL 21.
Client Alert 2020-237
