Topic: Risk of the police misidentifying the owner of an address (Read 1293 times)

You seem to be assuming that the "bandits" will act in the smartest way possible, and that the police will assume that they do so.  To my knowledge, neither is true: bandits often make mistakes, and the police depends a lot on them doing so

But we'll have to wait and see, I guess...

Discouraging crime depends on  the police being reasonably efficient at catching criminals after the fact, more than catching them when they attempt to commit the crime.  If murderers, thieves, rapists could only be caught on the act, they would only have to commit their crimes when the police is not around.

I don't  see how one could stop the continuing epidemics of goxitis -- "hackers stole all your bitcoins, sorry" -- and other forms of bitcoin theft except by tracking the stolen coins and identifying the thieves.   Are you saying that this will not be possible, and should not be?

I think your example shows why this fear is misplaced.  In fact, I think it shows once again how bitcoin tends to align the incentives of the individual with the interests of the community.  

You demonstrated how Bandit X could easily link "dirty" BTC to Person Y.  But then Bandit X could create similar links to Person A, B, C, …. too.  Successful bandits are incentivized to add as much confusion as possible so that the apparent links lose there meaning and they can more easily spend their loot.

But this is also in the best interest of the community.  If the financial links lose their meaning, it becomes more efficient for police to stop crime by "stopping the crime in the first place."  If it is more efficient to stop crime in the first place, this is where I expect police will direct their efforts.  If this is where they direct their efforts, the community likely wins both by having less crime, and by having less fear of being hassled for non-crimes.

Win-win.  

Indeed they are the same thing, the problem is that it seems much easier to tie an innocent person to a "dirty" bitcoin address than to a "dirty" bank account.

EDIT: Note that, in the original scenario, address A1 is created and controlled by X, not by Y.  So it is  not the same thing as depositing dirty money into someone else's legitimate bank account (or dirty coins into someone else's legitimate address).  The crucial difference is that X can take out the bulk of the dirty money from that account.

I don't see any difference legally between these "dirty" BTC deposited at a Bitcoin address and dirty USD deposited at a bank.

I wonder if the anonimity of bitcoin addresses could create risks of misidentification of address owners by the police, even for people who have never used bitcoins.

Suppose that a "bandit" X generates a new address A1, deposits a pile of "dirty" bitcoins in it.

X then makes some small purchase from a retailer Z, pretending to be some other person Y who has nothing to do with the matter.  He provides Y's physical address for delivery (if the purchase is a physical item) and pays in bitcoins out of address A1 to the retailer's address A2. Then X moves the rest of the dirty coins from A1 to a tumbler, or whatever.

While following the trail of the "dirty" bitcoins, the police gets to address A1, notices the small transaction to address A2, that they recognize as belonging to retailer Z. From the retailer's record of the purchase, they identify Y and conclude that he must be the owner of address A1 and hence of the "dirty" coins.

For bandit X, the purpose of this this ruse would be to delay the police's pursuit, or even permanently derail it.  He could choose the innocent decoy Y so that the suspicion would seem plausible -- eg. someone not very computer-savy and with criminal background, large debts, drug addiction, etc. 

Many variants of this trick seem possible.  Bandit X could do the same with dozens of decoys, to get the police bogged down into checking dozens of false leads. 

Is this risk significant?  If so, how could it be reduced?

Criminals already use this trick with bank accounts. However, the risk for bandit X is very high in the bank version, because he must steal Y's identity and impersonate him when creating the bank account A1.  On the other hand, the police usually can figure out very quickly that Y did not create that account nor issue the payment and transfer orders.  (Here in Brazil, the innocent victim Y is called "an orange" in fraud jargon, and he is usually some poor semi-literate guy who does not even have a bank account and lives far from the branch where the account is opened.)

With bitcoin addresses, however, the risk for X is very small, since he does not have to get Y's documents nor interact with anyone else to pull the trick, other than issue the bitcoin transaction requests and the bogus purchase order in Y's name; while Y can be any person in the world, and he has no way of proving to the police that he is not the owner of address A1 and did not make the fatal purchase.   His only hope is that the police can trace the path of the purchase order and/or the bitcoin transaction requests on the internet, and determine that they could not have been issued from any computer that Y could have accessed.