In a gripping tale sure to excite die-hard Potter fans everywhere, the English High Court has granted a so-called ‘Harry Potter injunction‘ (i.e. a protective injunction against persons unknown[1]) restraining the dissipation of Bitcoin from a specified Bitcoin exchange.
Aside from tenuous/clickbait-worthy links to children’s literature, the case is of interest for two main reasons:
- Bitcoin as property?: this case reinforces the growing trend for the English courts to treat crypto-currency as property.
- Remedies available to ransom victims (and their insurers): cyber-ransom is a very modern phenomenon, and this judgment demonstrates the growing arsenal of remedies available to victims/their insurers.
The judgment of Bryan J can be found here[2].
Factual background/context
This application for interim injunctive relief arose out of an October 2019 malware attack on a Canadian insurance company (the “Insured“) during which the hackers (i.e. the first and second defendants: persons unknown) locked the Insured out of its own computer systems, and demanded a ransom of USD $950,000 (payable in Bitcoin).
That ransom was eventually paid – via a (legitimate) intermediary which “specialises in the provision of negotiation services in relation to crypto currency ransom payments” (para.3).
Luckily for the Insured, it had taken out a cyber-crime policy with an English insurer (the “Insurer“) and so it was the Insurer which ended up funding the ransom payment. As a result, the Insurer became entitled to assert rights of subrogation and step into the shoes of the Insured to bring this application for proprietary injunctive relief.
After conducting an investigation via yet another specialist firm (“a provider of software to track payment of crypto currency“[3]), the Insurer eventually tracked the payment to a Bitcoin exchange controlled by the third and fourth defendants (the “Exchange“).
The relief sought
The Insurer’s claims in the main action were treated as being confined to restitution and/or to affix all four defendants as constructive trustees[4], i.e. proprietary remedies.
In support of those main proprietary remedies, the Insurer applied for (and was granted) 1. a proprietary injunction against all four defendants, and 2. ancillary relief “in terms of providing information so that location of assets etc…can be obtained” (para.66).
Bitcoin as property?
A pre-requisite to being granted a proprietary injunction (i.e. restraining the defendant/respondent from dissipating assets), is that the subject matter of the injunction is considered to be “property” as a matter of law (see para. 55).
The proprietary (or otherwise) status of crypto-currency has been a matter of some debate in recent years. The original conceptual difficulty with treating crypto-currency as true “property” is that “English law traditionally views property as being of only two kinds, choses in possession and choses in action” (para.55):
- Choses in possession: since crypto-currency is virtual, it cannot be possessed.
- Choses in action (i.e. a legal right/claim): similarly, “Bitcoin are not choses in action because they do not embody any right capable of being enforced by action.”
However, the above formulation is derived from appellate authority which is almost 150 years old (1885)[5]; the Victorian Court of Appeal can be forgiven for having failed to foresee how the advent of crypto-currency would not fall neatly into their restrictive formulation.
Helpfully, UK jurists have not been idle and the trend of legal commentary has been to interpret the law as having moved on. Indeed, in November 2019 the UK Jurisdiction Taskforce (“UKJT“) issued a “Legal Statement on Cryptoassets and Smart Contracts“[6] which concluded that – in principle – crypo-currency can be treated as property.
In this case, Bryan J lent emphatic judicial endorsement to this view, holding that “Essentially, and for the reasons identified in that legal statement, I consider that a crypto asset such as Bitcoin are property” (para.59).
Bryan J’s holding adds to the growing weight of (albeit first instance) authority where crypto-currency has been deemed to be property[7].
HL Commentary: the key take-away points[8]
1. Bitcoin/crypto-currency as property
It is clear that the judicial trend is to deem crypto-currency to be property. Given the widely publicised UKJT commentary and the line of High Court judgments which now endorse that view, it is unlikely that any first instance judge will feel inclined to swim against that judicial tide.
But why does all this matter? It is often claimed (inaccurately) that ‘possession is nine-tenths the law‘. In fact, when you dig a little deeper, it becomes clear that in a multitude of legal contexts – e.g. insolvency, the interpretation of various statutes, the law of trusts and restitution – property is most definitely king. To quote the UKJT:
“It matters because in principle proprietary rights are recognised against the whole world, whereas other—personal—rights are recognised only against someone who has assumed a relevant legal duty.”
2. Remedies and insurance
Insureds: the lesson here for companies worried about their cyber-crime exposure is to take out comprehensive insurance.
Insurers: the comfort offered by this judgment to insurers exercising rights of subrogation is that cyber-crime loss payments are not necessarily sunk costs, lost forever to the dark web. While the apparent attraction of crypto-currency to cyber-criminals has been the perception of the lack of traceability and accountability, this case demonstrates the flexibility of the English courts in providing creative solutions to remedy 21st century problems which Victorian jurisprudence could not have been expected to envisage.
***********************
Footnotes:
[1] Popularised in the early noughties with a series of injunctions sought by Bloomsbury, the publishers of the Harry Potter series, against “John Does”/persons unknown who might obtain pre-publication copies unlawfully.
[2] Paragraph references are to the judgment. AA v (1) Persons Unknown Who Demanded Bitcoin on 10th and 11th October 2019, (2) Persons Unknown Who Own/Control Specified Bitcoin, (3) iFINEX trading as BITFINEX, (4) BFXWW INC trading as BITFINEX [2019] EWHC 3556 (Comm).
[3] Paragraph 13. Thus indicating that there is apparently a burgeoning legitimate quasi-law enforcement industry growing out of the epidemic of cyber-crime.
[4] There were various other alternative causes of action, but for the purposes of this application – in order to circumvent certain jurisdictional issues – the Insurer’s claims were treated as being limited to these: see para. 52.
[5] Colonial Bank v Whinney [1885] 30 Ch.D 261.
[6] See the Hogan Lovells commentary here.
[7] See Vorotyntseva v Money-4 Limited [2018] EWHC 2598 (Ch), and Liam David Robertson v Persons Unknown (unreported 15th July 2019).
[8] This case also provides helpful commentary – beyond the scope of this article – on a) the CPR 39 circumstances in which it will be appropriate, as here, for a hearing to take place in private (para.s 16-33), b) the circumstances in which it is appropriate to issue an application without notice to some defendants/respondents but not others (para.s 34-35), and c) on the CPR PD 6B jurisdictional gateway difficulties posed by seeking Banker’s Trust, Norwich Pharmacal, and freezing orders/injunctions against foreign domiciled entities (para.s 38-49).
[View source.]
